D3FEND™ - A knowledge graph of cybersecurity countermeasures
type: Ontology
version IRI: d3fend.owl
release-date: 2025-08-01T00:12:00+00:00
description: D3FEND is a framework which encodes a countermeasure knowledge base as a knowledge graph. The graph contains the types and relations that define key concepts in the cybersecurity countermeasure domain and the relations necessary to link those concepts to each other. Each of these concepts and relations are linked to references in the cybersecurity literature.
license: MIT
comment: Use of the D3FEND Knowledge Graph, and the associated references from this ontology are subject to the Terms of Use. D3FEND is funded by the National Security Agency (NSA) Cybersecurity Directorate and managed by the National Security Engineering Center (NSEC) which is operated by The MITRE Corporation. D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. This software was produced for the U.S. Government under Basic Contract No. W56KGU-18-D0004, and is subject to the Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation Clause 252.227-7014 (FEB 2012) Copyright 2022 The MITRE Corporation.
version info: 1.2.0

attack-id
type: AnnotationProperty
definition: x attack-id y: The offensive technique x has the att&ck unique id of y.
sub property of: attack-kb-annotation
range: string
domain: Offensive Technique

attack-kb-annotation
type: AnnotationProperty
definition: x attack-kb-annotation y: The offensive technique x has the kb annotation of y.
sub property of: d3fend-annotation
domain: Offensive Technique

cwe-id
type: AnnotationProperty
sub property of: cwe-kb-annotation

cwe-kb-annotation
type: AnnotationProperty
sub property of: d3fend-annotation

d3fend-annotation
type: AnnotationProperty
definition: x d3fend-annotation y: The d3fend object x has the annotation y.
sub property of: versionInfo

d3fend-catalog-annotation-property
type: AnnotationProperty
alternative label: d3fend-vendor-registry-annotation-property
sub property of: d3fend-annotation

d3fend-display-annotation
type: AnnotationProperty
sub property of: d3fend-annotation

d3fend-kb-annotation-property
type: AnnotationProperty
definition: x d3fend-kb-annotation-property y: The entity x had the d3fend kb annotation y.
sub property of: d3fend-annotation

d3fend-kb-reference-annotation
type: AnnotationProperty
definition: x d3fend-kb-data-property y: The reference x has the data property y.
sub property of: d3fend-kb-annotation-property
range: string
domain: Technique Reference

definition
type: AnnotationProperty
definition: x definition y: The d3fend object x has the definition y.
sub property of: d3fend-annotation

description
type: AnnotationProperty
definition: A statement that represents something in words.
sub property of: d3fend-catalog-annotation-property

display-baseurl
type: AnnotationProperty
definition: A base string to use as prefix to create a full URL for an entity. The baseurl must end in a forward slash: /
sub property of: d3fend-display-annotation

display-order
type: AnnotationProperty
definition: x display-order y: An object x should be displayed in ordinal position y when placed or listed in a d3fend display with other objects of its kind.
sub property of: d3fend-display-annotation

display-priority
type: AnnotationProperty
sub property of: d3fend-display-annotation

kb-abstract
type: AnnotationProperty
definition: x kb-abstract y: The reference x has the abstract y.
sub property of: d3fend-kb-reference-annotation
range: string
domain: Technique Reference

kb-article
type: AnnotationProperty
definition: The technique x has the kb-article y, where y is written in Markdown.
sub property of: d3fend-kb-reference-annotation
range: string
domain: Technique

kb-author
type: AnnotationProperty
definition: x kb-author y: The reference x has some author y.
sub property of: d3fend-kb-reference-annotation
range: string
domain: Technique Reference

kb-mitre-analysis
type: AnnotationProperty
definition: x kb-mitre-analysis y: The reference x has the mitre d3fend analysis y.
sub property of: d3fend-kb-annotation-property
range: string
domain: Technique Reference

kb-organization
type: AnnotationProperty
definition: x kb-organization y: The reference x was created or owned by the organization y.
sub property of: d3fend-kb-annotation-property

label
type: AnnotationProperty
sub property of: label

pref-label
type: AnnotationProperty
definition: x pref-label y: The preferred display value for x is y in d3fend tools.
sub property of: d3fend-annotation

release-date
type: AnnotationProperty
definition: x release-date y: The object x has the release-date y.
sub property of: d3fend-annotation
sub property of: versionInfo

synonym
type: AnnotationProperty
definition: an equivalent term.
sub property of: d3fend-annotation

isDefinedBy
type: AnnotationProperty

abuses
type: ObjectProperty
sub property of: uses
definition: x abuses y: The entity x applies an artifact y to a wrong thing or person; x applies y badly or incorrectly.
alternative label: misapplies
alternative label: misuses

access-mediated-by
type: ObjectProperty
sub property of: associated-with
inverse of: mediates-access-to
definition: x access-mediated-by y: The entity or resource x has its access regulated, controlled, or facilitated by entity y, which acts as an intermediary or gatekeeper to enforce access control policies.

accessed-by
type: ObjectProperty
sub property of: associated-with
sub property of: may-be-accessed-by
inverse of: accesses
definition: x accessed-by y: The entity or resource x is accessed by entity y.

accesses
type: ObjectProperty
sub property of: associated-with
sub property of: may-access
definition: x accesses y: An subject x takes the action of reading from, writing into, or executing the stored information in the object y. Reads, writes, and executes are specific cases of accesses.

addressed-by
type: ObjectProperty
sub property of: associated-with
inverse of: addresses
definition: x addressed-by y: Relates a resource x (e.g., network host, peripheral device, disk sector, a memory cell or other logical or physical entity) to a discrete address y in an address space that points to it.

addresses
type: ObjectProperty
sub property of: associated-with
definition: x addresses y: Relates a pointer x to a digital artifact y located in the address space to which x points. The address space is part of some digital store, whether it be in memory, an image, or a persistent storage device.
alternative label: points-to

adds
type: ObjectProperty
sub property of: associated-with
sub property of: may-add
definition: x adds y: The subject x adds a data object y, such as a file, to some other digital artifact, such as a directory. Examples include an agent or technique adding a record to a database. or a domain entry to a DNS server.

analyzes
type: ObjectProperty
sub property of: associated-with
sub property of: detects
definition: x analyzes y: The subject x break down object y into components or essential features, assessing y by quantitative methods, qualitative methods, or both. Usually the analysis is done in terms of some model or framework.

associated-with
type: ObjectProperty
sub property of: may-be-associated-with
definition: x associated-with y: The subject x and object y are associated in some way. This is the most general definite relationship in d3fend (i.e., most general relationship that is not prefixed by 'may-'.)

attached-to
type: ObjectProperty
sub property of: associated-with
definition: x attached-to y: A subject x is joined in close association to an object y.

attack-may-be-countered-by
type: ObjectProperty
sub property of: may-be-tactically-associated-with

authenticates
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x authenticates y: The subject x establishes the authenticity of some y. This relation indicates an authentication event has occurred.

authorizes
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x authorizes y: A subject x grants authorization or clearance for an agent y to use an object. This relation indicates an authorization event has occurred.

blocks
type: ObjectProperty
sub property of: counters
sub property of: filters
definition: x blocks y: The entity x blocks off the use of digital artifact y by reference to a block or allow list (or both.)

broader
type: ObjectProperty
sub property of: semantic-relation
definition: x broader y: The entity x represents a more general or inclusive concept than entity y.

broader-transitive
type: ObjectProperty
sub property of: semantic-relation
definition: x broader-transitive y: The entity x represents a more general concept than entity y, including indirect or hierarchical relationships where x encompasses y through intermediate entities.

caused-by
type: ObjectProperty
sub property of: associated-with
inverse of: causes
definition: x caused-by y: The event or action x occurs as a consequence of event or action y.

causes
type: ObjectProperty
sub property of: associated-with
definition: x causes y: The event or action x brings about event or action y as a consequence.

communicates-with
type: ObjectProperty
sub property of: associated-with
type: SymmetricProperty
definition: x communicates-with y: x and y exchange signals or data bidirectionally, enabling mutual awareness, coordination, or interaction.

configures
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x configures y: The entity x sets the operational parameters of entity y, determining how y will operate.

connected-to
type: ObjectProperty
sub property of: associated-with
definition: x connected-to y: The subject x shares a direct physical or logical link with object y such that communication is possible between them without intermediate routing.

connects
type: ObjectProperty
sub property of: associated-with
definition: x connects y: The subject x joins system y by means of communication equipment (to some other system, typically the adversary-targeted host).

contained-by
type: ObjectProperty
sub property of: associated-with
sub property of: may-be-contained-by
inverse of: contains
type: TransitiveProperty
definition: x contained-by y: The entity x exists within or is physically or logically enclosed by entity y.

contains
type: ObjectProperty
sub property of: associated-with
sub property of: may-contain
type: TransitiveProperty
definition: x contains y: A core relation that holds between a whole x and its part y. Equivalent to relational concept 'has part' and thus transitive.

controlled-by
type: ObjectProperty
sub property of: associated-with
inverse of: controls
definition: x controlled-by y: x's operation or behavior is directed or regulated by y.

controls
type: ObjectProperty
sub property of: associated-with
definition: x controls y: x directs or regulates y's operational state, behavior, or function.

copies
type: ObjectProperty
sub property of: creates
definition: x copies y: An technique or agent x reproduces or makes and exact copy of some digital artifact y.

copy-of
type: ObjectProperty
sub property of: associated-with
definition: x copy-of y: The subject x is a duplicate of the object y.

counters
type: ObjectProperty
sub property of: may-counter

created-by
type: ObjectProperty
sub property of: associated-with
sub property of: may-be-created-by
inverse of: creates
definition: x created-by y: The entity x is brought into existence, developed, or generated by entity y.

creates
type: ObjectProperty
sub property of: associated-with
sub property of: may-create
definition: x creates y: The subject x bring into existence an object y. Some technique or agent x creates a persistent digital artifact y (as opposed to production of a consumable or transient object.); i.e., bring forth or generate

d3fend-general-object-property
type: ObjectProperty
sub property of: d3fend-object-property

d3fend-kb-object-property
type: ObjectProperty
sub property of: d3fend-object-property
definition: x d3fend-kb-object-property y: The object y is a d3fend knowledge base object property. These properties allow the linkage of knowledge and information supporting and illustrating the d3fend model.

d3fend-object-property
type: ObjectProperty

d3fend-process-object-property
type: ObjectProperty
sub property of: d3fend-object-property

d3fend-tactical-verb-property
type: ObjectProperty
sub property of: d3fend-object-property

deceives
type: ObjectProperty
sub property of: counters

deceives-with
type: ObjectProperty
sub property of: d3fend-tactical-verb-property
definition: x deceives-with y: The entity x misleads or manipulates another entity using y as a tool, method, or mechanism to create false perceptions or understanding.

decodes
type: ObjectProperty
sub property of: associated-with
definition: x decodes y: Entity x transforms data y to a different form, usually through decompression.

deletes
type: ObjectProperty
sub property of: evicts
sub property of: modifies
definition: x deletes y: A technique or agent x wipes out the digitally or magnetically recorded information of digital object y.

dependent
type: ObjectProperty
sub property of: associated-with
definition: x dependent y: A dependent y is an entity that requires the fulfillment of the requirements specified in dependency x.

depends-on
type: ObjectProperty
sub property of: associated-with
inverse of: has-dependent
definition: x depends-on y: The entity x is contingent on y being available; x relies on y.

detects
type: ObjectProperty
sub property of: counters
sub property of: d3fend-tactical-verb-property
definition: x detects y: The entity x discovers the presence, occurrence, or state of entity y through observation or measurement.

disables
type: ObjectProperty
sub property of: evicts
sub property of: may-disable
sub property of: modifies
definition: x disables y: The technique or agent x makes an entity y unable to perform its actions or capabilities.

drives
type: ObjectProperty
sub property of: associated-with
definition: x drives y: The device driver x causes a system component y to function by controlling it.

employed-by
type: ObjectProperty
sub property of: associated-with
inverse of: employs
definition: x employed-by y: An entity x is put into service by a technique or agent y. Inverse of y employs x.

employs
type: ObjectProperty
sub property of: associated-with
definition: x employs y: The entity x makes purposeful use of entity y to perform a function.

enabled-by
type: ObjectProperty
sub property of: associated-with
inverse of: enables
definition: x enabled-by y: A top level technique y enables a tactic x, that is, the property indicates that a technique y is used to put a particular tactic x into action. In other words, y renders x capable or able for some task. Inverse of enables.

enables
type: ObjectProperty
sub property of: associated-with
definition: x enables y: A top level technique x enables a tactic y, that is, the property indicates that a technique x is used to put a particular tactic y into action. In other words, x renders y capable or able for some task.

encodes
type: ObjectProperty
sub property of: associated-with
definition: x encodes y: Entity x transforms data y to a different form, usually through compression.

encrypts
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x encrypts y: The entity x converts the ordinary representation of a digital artifact y into a secret code.

end
type: ObjectProperty
sub property of: d3fend-process-object-property

enforces
type: ObjectProperty
sub property of: associated-with
definition: x enforces y: Technique x forces entity y to be compliant with a law, rule, or obligation.

enumerates
type: ObjectProperty
sub property of: reads
definition: x enumerates y: The subject x takes the action of reading from a digital source y to acquire data and create a list of its contents.

erases
type: ObjectProperty
sub property of: associated-with
definition: x erases y: A technique x removes recorded data from storage device y creating space for new data.

evaluated-by
type: ObjectProperty
sub property of: associated-with
inverse of: evaluates
definition: x evaluated-by y: The entity x is assessed and analyzed by entity y.

evaluates
type: ObjectProperty
sub property of: associated-with
sub property of: may-evaluate
definition: x evaluates y: The entity x systematically assesses entity y to judge its state, quality, or risk.

evicts
type: ObjectProperty
sub property of: counters
sub property of: d3fend-tactical-verb-property
sub property of: may-evict
definition: x evicts y: The entity x forcibly removes entity y from the environment or resource where y was residing.

exactly
type: ObjectProperty
sub property of: semantic-relation
definition: x exactly y: The entity x is identical to or fully corresponds to entity y.

excises
type: ObjectProperty
sub property of: associated-with
definition: x excises y: Technique x removes a section of entity y.

executed-by
type: ObjectProperty
sub property of: associated-with
inverse of: executes
definition: x executed-by y: The entity or function x is carried out, performed, or run by entity y.

executes
type: ObjectProperty
sub property of: accesses
sub property of: may-execute
sub property of: runs
definition: x executes y: The subject x takes the action of carrying out (executing) y, which is a single software module, function, or instruction.

extends
type: ObjectProperty
sub property of: modifies
definition: x extends y: The entity x extend the scope or range or area of entity y, especially in the sense of widen the range of applications.

filters
type: ObjectProperty
sub property of: associated-with
sub property of: isolates
definition: x filters y: An technique or agent x removes some specified set of of entities from the content of a digital artifact y, by passing an artifact's content through a filter. A filter is a device that removes something from whatever passes through it.

forges
type: ObjectProperty
sub property of: creates
definition: x forges y: An technique or agent x counterfeits a digital artifact y, such as a fake credential, with the intent to deceive.

fork
type: ObjectProperty
sub property of: d3fend-process-object-property

hardens
type: ObjectProperty
sub property of: counters
sub property of: d3fend-tactical-verb-property
definition: x hardens y: The entity x fortifies entity y to reduce its weaknesses so y can better withstand attack or failure.

has-account
type: ObjectProperty
sub property of: owns
definition: x has-account y: The subject x has ownership or possession of some account y.

has-agent
type: ObjectProperty
sub property of: has-participant
definition: x has-agent y: The event x occurs because agent y actively carries it out.

has-audience
type: ObjectProperty
sub property of: d3fend-use-case-object-property

has-contribution
type: ObjectProperty
sub property of: d3fend-kb-object-property

has-contributor
type: ObjectProperty
sub property of: d3fend-kb-object-property

has-dependent
type: ObjectProperty
sub property of: associated-with
definition: x has-dependent y: The entity x is relied upon or required by entity y.

has-goal
type: ObjectProperty
sub property of: d3fend-use-case-object-property

has-location
type: ObjectProperty
sub property of: associated-with
definition: x has-location y: The entity x is situated in a particular spot or position y.
alternative label: located_in

has-mediator
type: ObjectProperty
sub property of: has-participant
definition: x has-mediator y: The entity x relies on or is facilitated by entity y.

has-member
type: ObjectProperty
sub property of: d3fend-kb-object-property
inverse of: member-of

has-participant
type: ObjectProperty
sub property of: associated-with
inverse of: participates-in
definition: x has-participant y: The event x involves an object y as a participant, indicating that y plays some role in the event, whether actively, passively, or otherwise.

has-prerequisite
type: ObjectProperty
sub property of: d3fend-use-case-object-property

has-procedure
type: ObjectProperty
sub property of: d3fend-general-object-property

has-recipient
type: ObjectProperty
sub property of: associated-with
definition: x has_recipient y: An agent y is the intended recipient and decoder of the information contained in communication x.

has-sender
type: ObjectProperty
sub property of: associated-with
definition: x has_sender y: An agent y is the sender and encoder of the information contained in communication x.

has-weakness
type: ObjectProperty
sub property of: may-have-weakness
inverse of: weakness-of
definition: x has-weakness y: The entity x exhibits a condition y that could, in some circumstances, lead to a vulnerability.

hides
type: ObjectProperty
sub property of: associated-with
range: Digital Artifact
definition: x hides y: A technique or operation x conceals the digital artifact y.

identified-by
type: ObjectProperty
sub property of: associated-with
inverse of: identifies
definition: x identified-by y: The entity x is recognized or described by entity y.

identifies
type: ObjectProperty
sub property of: associated-with
definition: x identifies y: The entity x recognizes or brings attention to entity y, making it distinct or clear through naming, description, or discovery.

impairs
type: ObjectProperty
sub property of: associated-with
definition: x impairs y: The entity or action x hinders entity y by reducing its normal function, capacity, or availability.

implemented-by
type: ObjectProperty
sub property of: associated-with
inverse of: implements
definition: x implemented-by y: The entity x is realized or brought into operation by entity y.

implements
type: ObjectProperty
sub property of: associated-with
definition: x implements y: The entity x realize entity y by putting its design or specification into effect.

initiates
type: ObjectProperty
sub property of: associated-with
definition: x initiates y: The entity or action x starts or triggers entity or function y, bringing it into action.

injects
type: ObjectProperty
sub property of: executes
definition: x injects y: The subject x takes the action of exploiting a security flaw by introducing (injecting) y, which is code or data that will change the course of execution or state of a computing process to an alternate course or state. Typically code injection is associated with adversaries intending the alternate course to facilitate a malevolent purpose; however, code injection can be unintentional or the intentions behind it may be good or benign.

installs
type: ObjectProperty
sub property of: associated-with
definition: x installs y: An entity x sets up a digital artifact y for subsequent use. For example, an installation program can install application software.

instructed-by
type: ObjectProperty
sub property of: associated-with
definition: x instructed-by y: A subject x takes machine instructions from object y.

instructs
type: ObjectProperty
sub property of: associated-with
definition: x instructs y: A subject x delivers machine instructions to object y.

interprets
type: ObjectProperty
sub property of: executes
sub property of: may-interpret
definition: x interprets y: The subject x interprets the executable script y. The sense of interprets is here 'Parse the source code and perform its behavior directly.'

inventoried-by
type: ObjectProperty
sub property of: associated-with
inverse of: inventories
definition: x inventoried-by y: The entity x is cataloged, recorded, or tracked by entity y.

inventories
type: ObjectProperty
sub property of: associated-with
definition: x inventories y: The entity x systematically discovers entity y and records its presence and key details for tracking.

invoked-by
type: ObjectProperty
sub property of: associated-with
sub property of: may-be-invoked-by
inverse of: invokes
definition: x invoked-by y: The entity x is called, triggered, or activated by entity y.

invokes
type: ObjectProperty
sub property of: executes
sub property of: may-invoke
definition: x invokes y: The subject x invokes a system service y by use of an instruction object y that interrupts the program being executed and passes control to the operating system to perform that operation.
alternative label: calls

isolates
type: ObjectProperty
sub property of: associated-with
sub property of: d3fend-tactical-verb-property
definition: x isolates y: The technique or agent x sets digital artifact y apart from other digital artifacts, sequestering y.

kb-reference
type: ObjectProperty
sub property of: d3fend-kb-object-property
inverse of: kb-reference-of
alternative label: has-technique-reference

kb-reference-of
type: ObjectProperty
sub property of: d3fend-kb-object-property
range: Cyber Technique
definition: x kb-is-example-of y: The reference x is an example of technique y.
alternative label: kb-is-example-of

limits
type: ObjectProperty
sub property of: restricts
definition: x limits y: An entity x specifies a designated limit beyond which some entity y cannot function or must be terminated.
alternative label: cutoff

loaded-by
type: ObjectProperty
sub property of: associated-with
inverse of: loads
definition: x loaded-by y: The entity x is brought into memory by entity y.

loads
type: ObjectProperty
sub property of: associated-with
definition: x loads y: The technique or process x transfers a software from a storage y to a computer's memory for subsequent execution.

manages
type: ObjectProperty
sub property of: associated-with
definition: x manages y: The technique or agent x watches and directs the use of a digital artifact y.
alternative label: oversees
alternative label: supervises

mapped-by
type: ObjectProperty
sub property of: associated-with
inverse of: maps
definition: x mapped-by y: The entity x is linked to another entity by entity y.

maps
type: ObjectProperty
sub property of: may-map
definition: x maps y: The entity x discovers and records how entity y is arranged and interconnected.

may-access
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-be-accessed-by
definition: x may-access y: They entity x may access the thing y; that is, 'x accesses y' may be true.

may-add
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-add y: They entity x may add the thing y; that is, 'x adds y' may be true.

may-be-accessed-by
type: ObjectProperty
sub property of: may-be-associated-with

may-be-associated-with
type: ObjectProperty
sub property of: d3fend-object-property
definition: x may-be-associated-with y: The subject x and object y may be associated in some way.

may-be-contained-by
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-contain
type: TransitiveProperty

may-be-created-by
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-create

may-be-deceived-by
type: ObjectProperty
sub property of: attack-may-be-countered-by
inverse of: may-deceive
pref-label: may be deceived by

may-be-detected-by
type: ObjectProperty
sub property of: attack-may-be-countered-by
inverse of: may-detect
pref-label: may be detected by

may-be-evicted-by
type: ObjectProperty
sub property of: attack-may-be-countered-by
inverse of: may-evict
pref-label: may be evicted by

may-be-hardened-against-by
type: ObjectProperty
sub property of: attack-may-be-countered-by
inverse of: may-harden
pref-label: may be hardened against by

may-be-invoked-by
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-invoke

may-be-isolated-by
type: ObjectProperty
sub property of: attack-may-be-countered-by
inverse of: may-isolate
pref-label: may be isolated by

may-be-modified-by
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-modify

may-be-tactically-associated-with
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-be-tactically-associated-with y: the defensive action x may be a tactic that counters offensive action y.

may-be-weakness-of
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-have-weakness
domain: Weakness
range: Artifact

may-contain
type: ObjectProperty
sub property of: may-be-associated-with
type: TransitiveProperty
definition: to potentially have as contents or constituent parts; comprise; include.

may-counter
type: ObjectProperty
sub property of: may-be-associated-with

may-counter-attack
type: ObjectProperty
sub property of: may-be-tactically-associated-with

may-create
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-create y: They entity x may create the entity y; that is, 'x creates y' may be true.

may-deceive
type: ObjectProperty
sub property of: may-counter-attack
pref-label: may deceive

may-detect
type: ObjectProperty
sub property of: may-counter-attack
pref-label: may detect

may-disable
type: ObjectProperty
sub property of: may-evict

may-evaluate
type: ObjectProperty
sub property of: may-be-associated-with

may-evict
type: ObjectProperty
sub property of: may-counter
sub property of: may-counter-attack
pref-label: may evict

may-execute
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may execute y: The subject x might take the action of carrying out (executing) y, which is a single software module, function, or instruction.

may-harden
type: ObjectProperty
sub property of: may-counter-attack
pref-label: may harden

may-have-weakness
type: ObjectProperty
sub property of: may-be-associated-with
domain: Artifact
range: Weakness

may-interpret
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-interpret y: They entity x may interpret the thing y; that is, 'x interprets y' may be true.

may-invoke
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-invoke y: They entity x may invoke the thing y; that is, 'x invokes y' may be true.

may-isolate
type: ObjectProperty
sub property of: may-counter-attack
pref-label: may isolate

may-map
type: ObjectProperty
sub property of: may-be-associated-with

may-modify
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-modify y: They entity x may modify the thing y; that is, 'x modifies y' may be true.

may-produce
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-produce y: They entity x may produce the thing y; that is, 'x produces y' may be true.

may-query
type: ObjectProperty
sub property of: may-be-associated-with

may-run
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-run y: They entity x may run the thing y; that is, 'x runs y' may be true.

may-transfer
type: ObjectProperty
sub property of: may-be-associated-with
definition: x may-transfer y: They entity x might send the thing y; that is, 'x transfers y' may be true.

mediates-access-to
type: ObjectProperty
sub property of: associated-with
definition: x mediates-access-to y: The entity x controls and brokers requests to reach entity y, enforcing the access rules that allow or deny it.

member-of
type: ObjectProperty
sub property of: d3fend-kb-object-property

modified-by
type: ObjectProperty
sub property of: associated-with
sub property of: may-be-modified-by
inverse of: modifies
definition: x modified-by y: The entity x is changed by entity y.

modifies
type: ObjectProperty
sub property of: accesses
sub property of: associated-with
sub property of: may-modify
definition: x modifies y: A technique or agent x causes a digital object y to change; become different; or undertake a transformation. Afterwards, the data or state held by a digital object is changed.
alternative label: alters

modifies-part
type: ObjectProperty
sub property of: may-modify
property chain axiom: modifies
property chain axiom: contains
definition: x modifies-part y: The entity x modifies a part of y. [Note: This is a rolification property for the rule 'if one modifies a part of a whole, they modify the whole.' Reasoning for this and similar semantics to come are under evaluation and not part of current d3fend inferences.]

monitors
type: ObjectProperty
sub property of: associated-with
sub property of: detects
definition: x monitors y: The technique or agent x keep tabs on; keeps an eye on; or keep the digital artifact y under surveillance.

narrower
type: ObjectProperty
sub property of: semantic-relation
definition: x narrower y: The entity x represents a more specific or focused concept than entity y.

narrower-transitive
type: ObjectProperty
sub property of: semantic-relation
definition: x narrower-transitive y: The entity x represents a more specific concept than entity y, including indirect or hierarchical relationships where x is a subset of y through intermediate entities.

neutralizes
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x neutralizes y: The technique x makes the execution of actions of y ineffective by preventing or counterbalancing the effect of y.

next
type: ObjectProperty
sub property of: d3fend-process-object-property

obfuscates
type: ObjectProperty
sub property of: evicts
sub property of: modifies
definition: x obfuscates y: The technique x makes the digital artifact y unclear or obscure. Typically obfuscation is a way to hide a digital artifact from discovery, use, or both.

originates-from
type: ObjectProperty
sub property of: associated-with
definition: x originates-from y: The digital event or artifact x began its network transit from a physical location y.

owns
type: ObjectProperty
sub property of: associated-with
definition: x owns y: The subject x has ownership or possession of some object y.
alternative label: possesses

participates-in
type: ObjectProperty
sub property of: associated-with
definition: x participates-in y: The object x takes part in the event y, signifying that x contributes to or is affected by the event’s occurrence in some way.

powered-by
type: ObjectProperty
sub property of: depends-on
inverse of: powers
definition: x powered-by y: x obtains its essential energy or force from y to perform its function or remain active.

powers
type: ObjectProperty
sub property of: has-dependent
definition: x powers y: x furnishes y with the energy or force required for y's functionality or operation.

preceded-by
type: ObjectProperty
sub property of: associated-with
inverse of: precedes
definition: x preceded-by y: The event or action x occurs after event or action y in time.

precedes
type: ObjectProperty
sub property of: associated-with
definition: x precedes y: The event or action x occurs before event or action y in time.

process-ancestor
type: ObjectProperty
sub property of: process-property
type: TransitiveProperty
definition: x process-ancestor y: The process y is a process ancestor of process x, indicating one or more process creation events were conducted were started at process y and subsequently created process x.

process-image-path
type: ObjectProperty
sub property of: process-property
definition: x process-image-path y: The filepath y is the process image path for the process x, indicating the path to the resource from which the process's image was loaded.
alternative label: processImagePath

process-parent
type: ObjectProperty
sub property of: process-ancestor
definition: x process-parent y: The process y created the process x (directly) with a create process event.
alternative label: processParent

process-property
type: ObjectProperty
sub property of: associated-with
definition: x process-property y: Process x has the a process-property y. This is generalization for specific process object properties.

process-user
type: ObjectProperty
sub property of: process-property
definition: x process-user y: The process x has been executed by the user y.
alternative label: processUser

produced-by
type: ObjectProperty
sub property of: associated-with
inverse of: produces
definition: x produced-by y: The entity x is created by entity y.

produces
type: ObjectProperty
sub property of: associated-with
sub property of: may-produce
definition: x produces y: The subject entity x or process produces a data object y, which may be discrete digital object or a stream (e.g., a stream such as network traffic.)
alternative label: outputs

provider
type: ObjectProperty
sub property of: associated-with
definition: x provider y: A provider y is an entity that supplies a service, system, or data resources to a dependent entity x.

quarantines
type: ObjectProperty
sub property of: associated-with
definition: x quarantines y: Technique x moves entity y to a place of isolation.

queries
type: ObjectProperty
sub property of: associated-with
sub property of: may-query
definition: x queries y: The entity x requests information or data from entity y.

reads
type: ObjectProperty
sub property of: accesses
definition: x reads y: The subject x takes the action of reading from a digital source y to acquire data and placing it into volatile memory for processing.

recorded-in
type: ObjectProperty
sub property of: associated-with
inverse of: records
definition: x recorded-in y: The event x is documented, logged, or otherwise preserved within the digital artifact y, which stores or encodes relevant data about the event.

records
type: ObjectProperty
sub property of: associated-with
definition: x records y: The digital artifact x makes a record of events y; set down in permanent form.

regenerates
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x regenerates y: The entity x discards the current digital artifact y and creates a new version that serves the same function.

related
type: ObjectProperty
sub property of: semantic-relation
definition: x related y: x has a symmetric associative relation to y.

restores
type: ObjectProperty
sub property of: associated-with
definition: x restores y: The entity x returns entity y to its known-good or previous state.

restricted-by
type: ObjectProperty
sub property of: associated-with
inverse of: restricts
definition: x restricted-by y: The entity x is limited, constrained, or regulated by entity y.

restricts
type: ObjectProperty
sub property of: associated-with
definition: x restricts y: An entity x bounds the use of entity y.

resume
type: ObjectProperty
sub property of: d3fend-process-object-property
definition: The agent or technique x continues a previous action on entity y. Usually occurs after suspension on y.

resumes
type: ObjectProperty
sub property of: associated-with
definition: The agent or technique x continues a previous action on entity y. Usually occurs after suspension on y.

runs
type: ObjectProperty
sub property of: associated-with
sub property of: may-run
definition: x runs y: To carry out a process or program y, as on a computer or a machine x; where y may be a large software assembly or a specific module or instruction. Examples: "run a new program on the Mac"; "the computer runs the application software".

semantic-relation
type: ObjectProperty
sub property of: associated-with
definition: x semantic-relation y: The entity x is conceptually or meaningfully connected to entity y.

signed-by
type: ObjectProperty
sub property of: validated-by
inverse of: signs
definition: x signed-by y: The digital artifact x includes a signature generated by the entity y, certifying the authenticity and integrity of x. This relationship indicates that x has undergone a validation process by y, using cryptographic measures to ensure that x is trustworthy and unaltered since the signing by y.

signs
type: ObjectProperty
sub property of: validates
definition: x signs y: The entity x applies a digital signature to the digital artifact y, thereby asserting its validity, integrity, and authenticity. Typically, this involves cryptographic techniques to securely bind the signature to y, ensuring that y's contents have not been altered and are authentic as endorsed by x.

spoofs
type: ObjectProperty
sub property of: associated-with
sub property of: deceives-with
definition: x spoofs y: The technique x creates a fake instance of a digital artifact y; that is, y is a decoy, fake, or counterfeit.

start
type: ObjectProperty
sub property of: d3fend-process-object-property

strengthens
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x strengthens y: The technique x make digital artifact y resistant (to harm or misuse.)

summarizes
type: ObjectProperty
sub property of: associated-with
definition: x summarizes y: The sensor x summarizes a set y of events concerning digital artifacts over time.

suspends
type: ObjectProperty
sub property of: evicts
definition: x suspends y: The agent or technique x pauses entity y.

terminates
type: ObjectProperty
sub property of: associated-with
sub property of: evicts
definition: x terminates y: The technique x brings to an end or halt to some activity y.
synonym: aborts

transmits
type: ObjectProperty
sub property of: associated-with
definition: x transmits y: The subject x actively emits object y onto a communication medium, rendering y observable and available for reception on that medium.
alternative label: sends

unloads
type: ObjectProperty
sub property of: evicts
definition: x unloads y: The technique or artifact performs the action of unloading some artifact (applications, kernel modules, or hardware drivers, etc.) from a computer's memory.

unmounts
type: ObjectProperty
sub property of: associated-with
definition: x unmounts y: An operation x removes the access via computer system's file system the availability of files and directories on a storage artifact y. Unmounts reverse or undo prior mount operations.

updates
type: ObjectProperty
sub property of: hardens
sub property of: modifies
definition: x updates y: The technique x updates the software for component y.

use-limits
type: ObjectProperty
sub property of: limits
definition: x use-limits y: An entity x specifies a designated number of uses beyond which some entity y cannot function or must be terminated.

used-by
type: ObjectProperty
sub property of: associated-with
inverse of: uses
definition: x used-by y: is inverse of y uses x.

uses
type: ObjectProperty
sub property of: associated-with
definition: x uses y: An entity x puts into service a resource or implement y; makes y work or employ for a particular purpose or for its inherent or natural purpose.

validated-by
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x validated-by y: The digital artifact x has its authenticity and correctness confirmed or verified by the technique, operation, or agent y.

validates
type: ObjectProperty
sub property of: associated-with
sub property of: hardens
definition: x validates y: The technique x proves the digital artifact y is valid; that is, x shows or confirms the validity of y.

verifies
type: ObjectProperty
sub property of: analyzes
sub property of: associated-with
definition: x verifies y: A technique x confirms the truth of a digital artifact y.

weakness-of
type: ObjectProperty
sub property of: may-be-weakness-of

writes
type: ObjectProperty
sub property of: accesses
definition: x writes y: The subject x takes the action of writing to a digital artifact y to store data and placing it into persistent memory for later reference.

archived-at
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
range: anyURI

attack-kb-data-property
type: DatatypeProperty
alternative label: attack-kb-property

date available
type: DatatypeProperty
sub property of: date
range: dateTime
definition: Date that the resource became or will become available.

capec-id
type: DatatypeProperty
sub property of: d3fend-kb-data-property
definition: Unique identifier for a CAPEC technique, i.e. a common attack pattern identified by the pattern CAPEC-[number].

comments
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
type: FunctionalProperty
range: string
definition: x comments y: x claim has provider comments y.

confidence
type: DatatypeProperty
sub property of: d3fend-catalog-data-property

control-name
type: DatatypeProperty
sub property of: d3fend-external-control-data-property
definition: The control (or control enhancement) name.

date created
type: DatatypeProperty
sub property of: date
range: dateTime
definition: Date of creation of the resource.

d3fend-artifact-data-property
type: DatatypeProperty
sub property of: d3fend-data-property
domain: Digital Artifact
definition: x d3fend-artifact-data-property y: The artifact x has the data property y.

d3fend-catalog-data-property
type: DatatypeProperty
sub property of: d3fend-data-property
sub property of: d3fend-external-control-data-property
alternative label: d3fend-vendor-registry-data-property

d3fend-comment
type: DatatypeProperty
sub property of: d3fend-kb-data-property
definition: x d3fend-comment y: The entity x has an D3FEND team written a public note about entity y.

d3fend-data-property
type: DatatypeProperty

d3fend-display-property
type: DatatypeProperty
sub property of: d3fend-data-property
definition: x d3fend-display-property y: An object x should be displayed using the display property y, when it applies.

d3fend-external-control-data-property
type: DatatypeProperty
sub property of: d3fend-data-property

d3fend-id
type: DatatypeProperty
sub property of: d3fend-kb-data-property
definition: Unique identifier for a D3FEND technique. D3-[Acronym].

d3fend-kb-data-property
type: DatatypeProperty
sub property of: d3fend-data-property
definition: x d3fend-kb-data-property y: The d3fend knowledge base object x has a data property y; e.g., a string capturing a particular aspect or section of a knowledge base article.

date
type: DatatypeProperty
sub property of: d3fend-data-property
range: dateTime
definition: A point or period of time associated with an event in the lifecycle of the resource.

expectation-rating
type: DatatypeProperty
sub property of: d3fend-catalog-data-property

has-link
type: DatatypeProperty
sub property of: d3fend-kb-data-property
range: anyURI
definition: x has-link y: The d3fend analysis x has the link y.

identifier
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
range: string

date issued
type: DatatypeProperty
sub property of: date
range: dateTime
definition: Date of formal issuance of the resource.

kb-reference-title
type: DatatypeProperty
sub property of: d3fend-kb-data-property
range: string
definition: x kb-reference-title y: The d3fend knowledge base reference x has the reference title string y.

date modified
type: DatatypeProperty
sub property of: date
range: dateTime
definition: Date on which the resource was changed.

name
type: DatatypeProperty
sub property of: d3fend-catalog-data-property

operating-system
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
range: string
definition: x operating-system y: The product x is supported on operating system y.

process-command-line-arguments
type: DatatypeProperty
sub property of: process-data-property
definition: x process-command-line-arguments y: The process x has the process command line arguments data y.

process-data-property
type: DatatypeProperty
sub property of: d3fend-artifact-data-property
definition: x process-data-property y: The process x has the data property y.

process-environmental-variables
type: DatatypeProperty
sub property of: process-data-property
definition: x process-environment-variables y: The process x has the process environmental variables data y.
alternative label: process-environmental-variable

process-identifier
type: DatatypeProperty
sub property of: process-data-property
definition: x process-identifier y: The process x has the process identifier y.

process-security-context
type: DatatypeProperty
sub property of: process-data-property
domain: Process
definition: x process-security-context y: The process x has the process security context data y.

date published
type: DatatypeProperty
sub property of: date
range: dateTime
definition: Date of publication of the resource.

rating
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
type: FunctionalProperty

risk-impact
type: DatatypeProperty
sub property of: d3fend-data-property
range: Datatype
  on datatype: integer
  with restrictions:
    min inclusive: 1
  with restrictions:
    max inclusive: 5
definition: Risk impact rating, expressed on a numeric scale from 1 (lowest impact) to 5 (highest impact) in the context of a 5x5 risk matrix. Impact is used here as a synonym for consequence, another popular term used in risk analysis.

risk-likelihood
type: DatatypeProperty
sub property of: d3fend-data-property
range: Datatype
  on datatype: integer
  with restrictions:
    min inclusive: 1
  with restrictions:
    max inclusive: 5
definition: Risk likelihood rating, expressed on a numeric scale from 1 (lowest likelihood) to 5 (highest likelihood) in the context of a 5x5 risk matrix.

stage
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
type: FunctionalProperty

text
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
definition: The text of the document (i.e., terms of license.)

title
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
range: string
definition: A name given to the resource.

date valid
type: DatatypeProperty
sub property of: date
range: dateTime
definition: Date (often a range) of validity of a resource.

version
type: DatatypeProperty
sub property of: d3fend-catalog-data-property
sub property of: d3fend-external-control-data-property
type: FunctionalProperty
range: Datatype
  union of: integer
  union of: string
definition: x version y: The product or service x has the version y.

windows-registry-data-property
type: DatatypeProperty
sub property of: d3fend-artifact-data-property
definition: x windows-registry-data-property y: The windows registry entry x has the property y.

windows-registry-key
type: DatatypeProperty
sub property of: windows-registry-data-property
definition: x value y: The key-value pair x has the key y.
alternative label: key

windows-registry-value
type: DatatypeProperty
sub property of: windows-registry-data-property
definition: x value y: The key-value pair x has the data value y.
alternative label: value

ANN-based Clustering
type: Class
subclass of: Cluster Analysis
type: NamedIndividual
d3fend-id: D3A-ABC
kb-article: ## References Wikipedia. (n.d.). Artificial neural network. [Link](https://en.wikipedia.org/wiki/Artificial_neural_network)
definition: Combines the principles of Artificial Neural Networks (ANN) and clustering methods.

ARIMA Model
type: Class
subclass of: Time Series Analysis
type: NamedIndividual
d3fend-id: D3A-AM
kb-article: ## References Wikipedia. (n.d.). Autoregressive integrated moving average. [Link](https://en.wikipedia.org/wiki/Autoregressive_integrated_moving_average)
definition: An autoregressive integrated moving average (ARIMA) model is a generalization of an autoregressive moving average (ARMA) model.
synonym: Autoregressive Integrated Moving Average Model

ARMA Model
type: Class
subclass of: Time Series Analysis
type: NamedIndividual
type: Time Series Analysis
d3fend-id: D3-ARMA
definition: Autoregressive-moving-average (ARMA) models provide a parsimonious description of a (weakly) stationary stochastic process in terms of two polynomials, one for the autoregression (AR) and the second for the moving average (MA).
kb-article: ## References Wikipedia. (n.d.). Autoregressive-moving-average model. [Link](https://en.wikipedia.org/wiki/Autoregressive%E2%80%93moving-average_model)
synonym: Autoregressive moving average model

ATTACK Enterprise Data Source
type: Class
subclass of: ATTACK Enterprise Thing

ATTACK Enterprise Mitigation
type: Class
subclass of: ATTACK Enterprise Thing
subclass of: Restriction
  on property: semantic-relation
  some values from: Defensive Technique
subclass of: Restriction
  on property: d3fend-comment
  some values from: string

ATTACK Enterprise Tactic
type: Class
subclass of: ATTACK Enterprise Thing

ATTACK Enterprise Technique
type: Class
subclass of: ATTACK Enterprise Thing

ATTACK Enterprise Thing
type: Class
subclass of: ATTACK Thing

ATTACK Merged Thing
type: Class
subclass of: ATTACK Thing

ATTACK Thing
type: Class
subclass of: External Threat Model Thing
definition: ATTACK things are concepts defined in the ATT&CK Framework.

Academic Paper Reference
type: Class
subclass of: Technique Reference
pref-label: Academic Paper

Access
type: Class
subclass of: Event
subclass of: Restriction
  on property: accesses
  some values from: Resource
subclass of: Restriction
  on property: has-mediator
  some values from: Access Mediator

Access Control Administration Event
type: Class
subclass of: Access Control Event
definition: An event concerning the administrative actions of setting, modifying, or abolishing permissions, configuring access control settings, and managing user access rights to ensure alignment with access control policies.
alternative label: Permission Administration Event
alternative label: Permission Provisioning Event

Access Control Configuration
type: Class
subclass of: Configuration Resource
type: NamedIndividual
definition: Information about what access permissions are granted to particular users for particular objects.

Access Control Event
type: Class
subclass of: Authorization Event
subclass of: Restriction
  on property: has-participant
  some values from: Access Control Configuration
definition: An event that captures the implementation or evaluation of access control measures, including the application of rules and policies to govern the accessibility of resources by agents within a digital system.

Access Control Group
type: Class
subclass of: Access Control Configuration
subclass of: Restriction
  on property: restricted-by
  some values from: Access Control List
type: NamedIndividual
restricted-by: Access Control List
definition: A collection of objects that can have access controls placed on them.

Access Control List
type: Class
subclass of: Access Control Configuration
subclass of: Restriction
  on property: restricts
  some values from: UserGroup
type: NamedIndividual
restricts: UserGroup
definition: A list of permissions attached to an object.

Access Denied Event
type: Class
subclass of: Access Mediation Event
definition: An event indicating the refusal of access to a resource, where an access request has been evaluated and denied based on current authorization policies, preventing operations by the requesting agent.

Access Granted Event
type: Class
subclass of: Access Mediation Event
definition: An event signifying that access to a resource has been authorized and successfully enforced, allowing the requesting agent to perform specified operations based on the access control policies.

Access Mediation
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Isolate
type: NamedIndividual
enables: Isolate
kb-reference: Reference-CNNSI-4009
d3fend-id: D3-AMED
synonym: Access Control
definition: Access mediation is the process of granting or denying specific requests to: 1) obtain and use information and related information processing services; and 2) enter specific physical facilities (e.g., Federal buildings, military establishments, border crossing entrances). Access mediation decisions should enforce least privilege by granting access for scoped durations to prevent privilege creep and, where applicable, implement just-in-time (JIT) access. Denial decisions may prevent initial access or terminate access that has already been granted, ensuring continuous enforcement of security policies.

Access Mediation Event
type: Class
subclass of: Access Control Event
subclass of: Restriction
  on property: has-participant
  some values from: Access Mediator
definition: An event involving the intermediary control mechanism that evaluates access requests and enforces access control decisions, ensuring that subjects' resource interactions comply with the established access policies.
alternative label: Access Enforcement Event

Access Mediator
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: implements
  some values from: Access Control Configuration
subclass of: Restriction
  on property: mediates-access-to
  some values from: Resource
subclass of: Restriction
  on property: used-by
  some values from: Agent
type: NamedIndividual
implements: Access Control Configuration
mediates-access-to: Resource
used-by: Agent
definition: An Access Mediator enforces access control policies to regulate interactions with a resource.

Access Modeling
type: Class
subclass of: Operational Activity Mapping
subclass of: Restriction
  on property: maps
  some values from: Access Control Configuration
subclass of: Restriction
  on property: maps
  some values from: Digital Identity
subclass of: Restriction
  on property: maps
  some values from: UserAccount
type: NamedIndividual
maps: Access Control Configuration
maps: Digital Identity
maps: UserAccount
d3fend-id: D3-AM
definition: Access modeling captures and records the access permissions granted to identities (e.g., administrators, users, groups, systems) and optionally includes details on how these identities are stored, managed, and shared across systems.

Access Policy Administration
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Isolate
type: NamedIndividual
enables: Isolate
d3fend-id: D3-APA
definition: Access policy administration is the systematic process of defining, implementing, and managing access control policies that dictate user permissions to resources.
synonym: Access Control Administration

Access Process
type: Class
subclass of: System Call
subclass of: Restriction
  on property: accesses
  some values from: Process
type: NamedIndividual
accesses: Process

Access Token
type: Class
subclass of: Credential
type: NamedIndividual
definition: In computer systems, an access token contains the security credentials for a login session and identifies the user, the user's groups, the user's privileges, and, in some cases, a particular application. Typically one may be asked to enter the access token (e.g. 40 random characters) rather than the usual password (it therefore should be kept secret just like a password).
alternative label: Ticket
alternative label: Token

Account Locking
type: Class
subclass of: Credential Eviction
subclass of: Restriction
  on property: disables
  some values from: UserAccount
type: NamedIndividual
disables: UserAccount
kb-reference: Reference-AccountMonitoring ForescoutTechnologies
kb-reference: Reference-FrameworkForNotifyingADirectoryServiceOfAuthenticationEventsProcessedOutsideTheDirectoryService OracleInternationalCorp
date created: 2020-08-05T00:00:00
d3fend-id: D3-AL
kb-article: ## How it works Management servers with enterprise policies for account management provide the ability to enable and disable account for given rules. The rules may include specific periods of time (eg. weekend, plant shutdown, leave periods), specific user types or groups, or individual users. ## Considerations * Local accounts caches vs centralized account management * Single Sign-on * Role based vs Attribute based systems ## Examples of account configuration stores * Directory Services * Active Directory * RADIUS * LDAP * Oracle User Account Management * JumpCloud
definition: The process of temporarily disabling user accounts on a system or domain.

Action
type: Class
subclass of: Event
subclass of: Restriction
  on property: has-agent
  some values from: Agent
type: NamedIndividual
definition: An Action is a deliberate operation or activity performed by an entity.

Active Certificate Analysis
type: Class
subclass of: Certificate Analysis
type: NamedIndividual
kb-reference: Reference-SecuringWebTransactions
date created: 2020-08-05T00:00:00
d3fend-id: D3-ACA
definition: Actively collecting PKI certificates by connecting to the server and downloading its server certificates for analysis.
kb-article: ## How it works Analysis of server certificates using active methods to detect if certificates have been misconfigured or spoofed by using elements of the certificate, certificate authorities and signatures. ### Certificate validity analysis This can be accomplished by verifying the digital signature on certificate. ### Certificate path analysis The client's browser can perform path verification to ensure that the server's certificate contains a valid trust anchor. ### Certificate configuration analysis Some browsers can be configured to implement the key-usage extensions contained certificates. This can help to prevent a certificate from being misused. ### Certificate revocation status analysis Using either Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) to determine the revocation status. OCSP Stapling, binding the status with the certificate, helps to mitigate potential delay in status verifications. ## Considerations * Management of the PKI across the enterprise typically requires automation to maintain scalability and flexibility * If the certificate authority, issuing the certificate, is compromised then all of the certificates issued by the CA are suspect * There may be delays associated with updates to certificates * Revoked certificates give the appearance of valid certificates until they are published to a trusted revocation service (OCSP or CRL) * The revocation service (OCSP or CRL) may be down during our connection and a browser will need to make a decision will need to be made about trusting the connection

Active Learning
type: Class
subclass of: Machine Learning
type: NamedIndividual
d3fend-id: D3A-AL
kb-article: ## How it works Traditional supervised learning often requires a large number of labeled instances, which can be costly or time-consuming to obtain. Active learning addresses this labeling bottleneck by asking an oracle (e.g., a human annotator) to label selected unlabeled instances. The goal is to achieve high accuracy with minimal labeling effort. ## Considerations Active learning is particularly useful in scenarios where data is abundant but labeled instances are scarce or expensive. Examples include speech recognition, information extraction, and document classification. ## References - Wikipedia article on Active Learning (machine learning) [Link](https://en.wikipedia.org/wiki/Active_learning_(machine_learning)) - Settles, B. (2009). Active Learning Literature Survey. [Link](https://burrsettles.com/pub/settles.activelearning.pdf)
definition: Active learning aims to improve learning efficiency by allowing the learning algorithm to select which data to learn from.

Active Logical Link Mapping
type: Class
subclass of: Logical Link Mapping
subclass of: Restriction
  on property: may-query
  some values from: Network Agent
type: NamedIndividual
kb-reference: Reference-IdentificationOfTracerouteNodesAndAssociatedDevices
kb-reference: Reference-SNMPNetworkAutoDiscovery
may-query: Network Agent
d3fend-id: D3-ALLM
kb-article: ## How it works Active logical link mapping establishes awareness of logical links in the network by sending data over the network to gather information about logical connections in the network. Typically this will be achieved through network telemetry coordinated for network management and monitoring and will use a link layer discovery protocol such as LLDP and the information gathered and aggregated a higher levels using an application protocol such as SNMP. The information may be polled by network management softare or configured once and then pushed from network sensors (or agents.) Another means of establishing network connectivity is by means of sendingn traffic through the use of a tool such as traceroute, to determine the logical paths through the network architecture. ## Considerations * Best practice is to encrypte network monitoring data and require authentication for queries or admin/management functions. * Push notifications reduce bandwidth necessary to capture and maintain information if reliable transport is used. * Special consideration should be made before using of active scanning in OT networks and OT-safe options chosen where available.
definition: Active logical link mapping sends and receives network traffic as a means to map the whole data link layer, where the links represent logical data flows rather than physical connection

Active Physical Link Mapping
type: Class
subclass of: Physical Link Mapping
subclass of: Restriction
  on property: may-query
  some values from: Network Agent
disjoint with: Direct Physical Link Mapping
type: NamedIndividual
kb-reference: Reference-IdentificationOfTracerouteNodesAndAssociatedDevices
may-query: Network Agent
d3fend-id: D3-APLM
synonym: Active Physical Layer Mapping
definition: Active physical link mapping sends and receives network traffic as a means to map the physical layer.

Activity Dependency
type: Class
subclass of: Dependency
definition: An activity dependency is a dependency that indicates an activity has an activity or agent which relies on it in order to be functional.

Actor-Critic
type: Class
subclass of: Policy Gradient
subclass of: Temporal Difference Learning
type: NamedIndividual
d3fend-id: D3A-AC
definition: Actor-Critic is a Temporal Difference(TD) version of Policy gradient. It has two networks: Actor and Critic. The actor decided which action should be taken and critic inform the actor how good was the action and how it should adjust. The learning of the actor is based on policy gradient approach. In comparison, critics evaluate the action produced by the actor by computing the value function.
kb-article: ## References The Actor-Critic Reinforcement Learning Algorithm. Medium. [Link](https://medium.com/intro-to-artificial-intelligence/the-actor-critic-reinforcement-learning-algorithm-c8095a655c14).

Actuator
type: Class
subclass of: Output Device
definition: An actuator is a mechanical or electromechanical device that, upon receiving a relatively low-energy control signal (e.g., electrical voltage, fluid pressure, or human force), translates its primary energy source (electric, hydraulic, or pneumatic) into targeted mechanical motion or adjustment. It typically works in conjunction with a control device (like a valve or logic driver) and is central to automation, enabling machines or systems to move, open, close, or otherwise manipulate their components or environment. By amplifying or redirecting energy from one form to another, the actuator executes control commands, thereby automating processes in industrial, automotive, aerospace, and other domains where precise mechanical action is essential.

Adaptive Resonance Theory Clustering
type: Class
subclass of: ANN-based Clustering
type: NamedIndividual
d3fend-id: D3A-ARTC
kb-article: ## References GeeksforGeeks. (n.d.). Adaptive Resonance Theory (ART). [Link](https://www.geeksforgeeks.org/adaptive-resonance-theory-art/)
definition: Adaptive Resonance Theory (ART) Clustering is a neural network algorithm used for clustering data and is open to new learning(i.e. adaptive) without discarding the previous or the old information(i.e. resonance).

Add User to Group Event
type: Class
subclass of: Group Management Event
subclass of: Restriction
  on property: has-participant
  some values from: UserAccount
subclass of: Restriction
  on property: preceded-by
  some values from: Group Creation Event
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
definition: An event where a user is added to a group, granting the user the permissions and privileges associated with the group.

Address Space
type: Class
subclass of: Digital Information Bearer
definition: An address space defines a range of discrete addresses, each of which may correspond to a network host, peripheral device, disk sector, a memory cell or other logical or physical entity. For software programs to save and retrieve stored data, each unit of data must have an address where it can be located. The number of address spaces available depends on the underlying address structure, which is usually limited by the computer architecture being used.

Administrative Network Activity Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Intranet Administrative Network Traffic
type: NamedIndividual
analyzes: Intranet Administrative Network Traffic
kb-reference: Reference-MethodAndSystemForDetectingSuspiciousAdministrativeActivity VectraNetworksInc
kb-reference: Reference-RemoteRegistry MITRE
kb-reference: Reference-WindowsRemoteManagement WinRM MITRE
date created: 2020-08-05T00:00:00
d3fend-id: D3-ANAA
kb-article: ## How it works Network protocols such as RDP, IPMI, SSH, SNMP, VNC, MOSH, NX, TeamViewer, SPICE, PCoIP, and others are used by system administrators to remotely manage servers. Defenders monitor administrative network activity to determine if the use of remote protocols is malicious. Attackers can abuse administrative protocols and leverage them for initial access to various endpoints. For example, an attacker with valid credentials will remotely SSH or RDP into a server and attempt to blend in with existing traffic from system administrators. By monitoring the traffic activity, it is possible to detect when the protocols are behaving differently from a known baseline of system administration activity. ## Considerations * Administrative traffic can be encrypted, making network protocol analysis a challenge * False alarms can be mitigated by integration with inventory management systems
definition: Detection of unauthorized use of administrative network protocols by analyzing network activity against a baseline.

Administrative Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: Administrative network traffic is network traffic related to the remote administration or control of hosts or devices through a standard remote administrative protocol. Remote shells, terminals, RDP, and VNC are examples of these protocols, which are typically only used by administrators.

Agent
type: Class
subclass of: D3FEND Core
type: NamedIndividual
definition: An entity capable of performing intentional actions.

Agent Authentication
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: authenticates
  some values from: Agent
subclass of: Restriction
  on property: enables
  some values from: Harden
subclass of: Restriction
  on property: strengthens
  some values from: UserAccount
type: NamedIndividual
authenticates: Agent
enables: Harden
kb-reference: Reference-NIST-Special-Publication-800-53-Revision-5
strengthens: UserAccount
d3fend-id: D3-AA
definition: Agent authentication is the process of verifying the identities of agents to ensure they are authorized and trustworthy participants within a system.

Agent Group
type: Class
subclass of: Group
subclass of: Restriction
  on property: contains
  some values from: Agent

Agglomerative Clustering
type: Class
subclass of: Hierarchical Clustering
type: NamedIndividual
d3fend-id: D3A-AC
definition: Agglomerative Clustering is a type of hierarchical clustering method where data points are grouped together based on similarity. Initially, each data point is treated as an individual cluster, and then in successive iterations, the closest clusters are merged until only one large cluster remains or until a specified stopping criterion is met.
kb-article: ## How it works Agglomerative clustering starts with each data point as its own cluster. The algorithm then iterates, identifying the two clusters that are closest to each other based on a defined distance metric (e.g., Euclidean, Manhattan). These two clusters are then merged into a single cluster. This process continues iteratively, merging the closest pairs of clusters in each step until all data points are merged into a single cluster or until other stopping criteria are achieved. A dendrogram, which is a tree-like diagram, can be used to represent the sequence of merges, providing a visual representation of the hierarchical structure of data. ## Considerations - **Choice of Distance Metric**: The outcome can vary significantly depending on the chosen distance metric (e.g., Euclidean, Manhattan). - **Scalability**: Agglomerative clustering can be computationally intensive for large datasets. - **Sensitivity**: The method can be sensitive to outliers, which might affect the quality of the clusters formed. ## Key Test Considerations - **Unsupervised Learning**: - **Number of Clusters**: Determine an optimal number of clusters using the dendrogram and techniques like the elbow method. - **Cluster Analysis**: - **Silhouette Score**: Evaluates how similar an object is to its own cluster compared to other clusters. A higher silhouette score indicates that the object is well matched to its own cluster and poorly matched to neighboring clusters. - **Dunn Index**: Measures the ratio between the smallest distance between observations not in the same cluster to the largest intra-cluster distance. - **Hierarchical Clustering**: - **Cophenetic Correlation Coefficient**: Measures the correlation between the distances of points in feature space and their distances on the dendrogram. Helps assess the fidelity of the dendrogram in preserving pairwise distances between samples. - **Agglomerative Clustering**: - **Linkage Criteria**: Test different linkage criteria (e.g., single, …

Alethic Logic
type: Class
subclass of: Modal Logic
type: NamedIndividual
d3fend-id: D3A-AL
kb-article: ## References 1. Alethic logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Alethic_logic)
definition: Alethic logic is a modal logic that addresses the modalities of necessity and possibility.

Alias
type: Class
subclass of: Slow Symbolic Link
definition: In macOS, an alias is a small file that represents another object in a local, remote, or removable[1] file system and provides a dynamic link to it; the target object may be moved or renamed, and the alias will still link to it (unless the original file is recreated; such an alias is ambiguous and how it is resolved depends on the version of macOS).

Allocate Memory
type: Class
subclass of: System Call
subclass of: Restriction
  on property: creates
  some values from: Memory Block
type: NamedIndividual
creates: Memory Block

Analytic Technique
type: Class
subclass of: Technique
definition: A process in which a computer examines information using mathematical methods in order to find useful patterns.

Analytical Purpose
type: Class
subclass of: Goal

Anonymous Pipe
type: Class
subclass of: Pipe
definition: In computer science, an anonymous pipe is a simplex FIFO communication channel that may be used for one-way interprocess communication (IPC). An implementation is often integrated into the operating system's file IO subsystem. Typically a parent program opens anonymous pipes, and creates a new process that inherits the other ends of the pipes, or creates several new processes and arranges them in a pipeline.

Answer Set Programming
type: Class
subclass of: Logic Programming
type: NamedIndividual
d3fend-id: D3A-ASP
definition: Answer set programming is a form of declarative programming based on the stable model (answer set) semantics of logic programming.
kb-article: ## How it works Answer set programming (ASP) is oriented towards difficult (primarily NP-hard) search problems. The computational process employed in the design of many answer set solvers is an enhancement of the DPLL algorithm and, in principle, it always terminates (unlike Prolog query evaluation, which may lead to an infinite loop). In a more general sense, ASP includes all applications of answer sets to knowledge representation and the use of Prolog-style query evaluation for solving problems arising in these applications. ## References 1. Answer set programming. (2023, April 27). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Answer_set_programming)
synonym: ASP

Application
type: Class
subclass of: Software
subclass of: Restriction
  on property: may-contain
  some values from: Application Configuration
type: NamedIndividual
may-contain: Application Configuration
definition: A program that gives a computer instructions that provide the user with tools to accomplish a task; "he has tried several different word processing applications". Distinct from system software that is intrinsically part of the operating system. An application can be made up of executable files, configuration files, shared libraries, etc.

Application-based Process Isolation
type: Class
subclass of: Execution Isolation
subclass of: Restriction
  on property: isolates
  some values from: Process
subclass of: Restriction
  on property: restricts
  some values from: Subroutine
type: NamedIndividual
isolates: Process
kb-reference: Reference-PrivateApplicationAccessWithBrowserIsolation
kb-reference: Reference-ProtectingWebApplicationsFromUntrustedEndpointsUsingRemoteBrowserIsolation
kb-reference: Reference-SiteIsolationDesignDocument
restricts: Subroutine
d3fend-id: D3-ABPI
kb-article: ## How it works Some applications implement logic to permit or deny a particular subroutine access to other data within the same applicaition process. This is intended to prevent critical application process data from being tampered with. ### Application-based Process Isolation in web browsers. Isolation in browsers usually is designed with the following architectural mindset: * Sandboxes and web resources should not be allowed to access each other because compromise of one should not effect the other. * The principle of least-privilege should be followed when browsing. The following aspects help make browser-based process isolation possible: * Same Origin Policy * Separate tabs and iframes use their own DOMs (cross-site document object models always run as a different process) * CORS ensures cross-site data is not delivered to a process unless the server allows it * Cookie and local data storage is separated by domain/site * Separate execution environments (threads) ## Considerations - Using isolation in browsers does mitigate and protect by default some types of attacks (e.g. renderer attacks and access to the filesystem) but it depends on correct configuration of CORS, use of valid/appropriate certificates. - Application-based Process Isolation may increase memory footprint. - Application-based Process Isolation may decrease application performance.
synonym: Browser-based Process Isolation
definition: Application code which prevents its own subroutines from accessing intra-process / internal memory space.
synonym: Remote Browser Isolation
synonym: Sandbox

Application Configuration
type: Class
subclass of: Configuration Resource
type: NamedIndividual
definition: Information used to configure the parameters and initial settings for an application.

Application Configuration Database
type: Class
subclass of: Configuration Database
subclass of: Restriction
  on property: contains
  some values from: Application Configuration Database Record
type: NamedIndividual
contains: Application Configuration Database Record
definition: A database used to hold application configuration data.

Application Configuration Database Record
type: Class
subclass of: Application Configuration
subclass of: Configuration Database Record
type: NamedIndividual
definition: A database record holding information used to configure the parameters and initial settings for an application.

Application Configuration File
type: Class
subclass of: Configuration File
subclass of: Restriction
  on property: contains
  some values from: Application Configuration
type: NamedIndividual
contains: Application Configuration
definition: A file containing Information used to configure the parameters and initial settings for an application.. A plist file is an example of this type of file for macOS. Usually text-based.

Application Configuration Hardening
type: Class
subclass of: Application Hardening
subclass of: Restriction
  on property: hardens
  some values from: Application Configuration
type: NamedIndividual
hardens: Application Configuration
kb-reference: Reference-Windows10STIG
d3fend-id: D3-ACH
kb-article: ## How it works Application configuration settings can be configured to limit the permissions on an application or disable certain vulnerable application features. Hardening an application's configuration involves analyzing not only the application but also the environment in which the application is run in for potential vulnerabilities.
definition: Modifying an application's configuration to reduce its attack surface.

Application Configuration Modification Event
type: Class
subclass of: Configuration Modification Event
subclass of: Restriction
  on property: has-participant
  some values from: Application Configuration
subclass of: Restriction
  on property: precedes
  some values from: Application Update Event
definition: An event in which the configuration of a specific software application is changed, affecting how that application executes, interacts with other components, or exposes functionality to users or services.

Application Deletion Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: preceded-by
  some values from: Application Installation Event
definition: An event capturing the removal of an application from a system, ensuring its binaries, configuration files, and registry entries are deleted or deactivated.

Application Disable Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: preceded-by
  some values from: Application Enable Event
definition: An event capturing the disabling of an application, preventing it from being operational or accessed until re-enabled.

Application Enable Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: preceded-by
  some values from: Application Installation Event
definition: An event representing the enabling of an application, allowing it to be started or accessed when required.

Application Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Application
definition: An event that captures the behavior, state, or interactions of software applications or services operating within a system. Application events encompass lifecycle changes, configuration updates, and operational anomalies, providing insight into the health and performance of software components.

Application Hardening
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Harden
type: NamedIndividual
enables: Harden
d3fend-id: D3-AH
definition: Application Hardening makes an executable application more resilient to a class of exploits which either introduce new code or execute unwanted existing code. These techniques may be applied at compile-time or on an application binary.
kb-article: ## Technique Overview Exploits may, for example, rely on knowledge of addresses in a process's memory, they may alter memory contents, and they may cause a program to use instructions in a way that they were not intended. By, for example, including code that dynamically changes the memory address of data or code on each run, introducing logic to validating the memory contents before certain potentially dangerous flows are executed, or monitoring a program for unusual sequence of instructions, this makes it harder for an attacker to craft a working exploit.
synonym: Process Hardening

Application Installation Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: has-participant
  some values from: Software Deployment Tool
definition: An event representing the installation of an application onto a system, making it available for use and interaction.

Application Installer
type: Class
subclass of: UserApplication
type: NamedIndividual
definition: An application installer is a user application designed to install, configure, and deploy another application.

Application Inventory Sensor
type: Class
subclass of: Endpoint Sensor
subclass of: Restriction
  on property: monitors
  some values from: Application
type: NamedIndividual
monitors: Application
definition: Collects information on applications on an endpoint.

Application Layer Event
type: Class
subclass of: Network Event
definition: An event occurring at the application layer, involving protocols that support application-specific communication.

Application Layer Firewall
type: Class
subclass of: Firewall
definition: An application firewall is a form of firewall that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. The application firewall is typically built to control all network traffic on any OSI layer up to the application layer. It is able to control applications or services specifically, unlike a stateful network firewall, which is - without additional software - unable to control network traffic regarding a specific application. There are two primary categories of application firewalls, network-based application firewalls and host-based application firewalls.
alternative label: Application Firewall

Application Layer Link
type: Class
subclass of: Logical Link
definition: An Application Layer Link is a type of logical link that exists at the application layer of a network or system architecture.

Application Process
type: Class
subclass of: UserProcess
subclass of: Restriction
  on property: runs
  some values from: Application
type: NamedIndividual
runs: Application
definition: An application process is an instance of an application computer program that is being executed.

Application Process Configuration
type: Class
subclass of: Application Configuration
definition: The current configuration of an application process, stored in memory. It may have been sourced from other types of application configurations, e.g. Application Configuration Files or Application Configuration Database Records.

Application Restart Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: preceded-by
  some values from: Application Stop Event
subclass of: Restriction
  on property: precedes
  some values from: Application Start Event
definition: An event where an application is sequentially stopped and started, typically to refresh its state, apply updates, or resolve issues while preserving its availability.

Application Rule
type: Class
subclass of: Application Configuration
definition: A configuration of an application which is used to apply logical or data processing functions to data processed by the application.

Application Shim
type: Class
subclass of: Shim
definition: An application shim adapts an application program to run on a version of a platform for which they were not originally created. Most commonly "Application Shimming" refers to use of The Windows Application Compatibility Toolkit (ACT) provides backward compatibility by simulating the behavior of older version of Windows.

Application Start Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: preceded-by
  some values from: Application Installation Event
definition: An event where an application transitions from an inactive state to an active state, initializing its resources and becoming operational for user interaction or automated processes.

Application Stop Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: preceded-by
  some values from: Application Start Event
definition: An event capturing the cessation of an application’s operations, transitioning it to an inactive state and releasing any allocated resources.

Application Update Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: preceded-by
  some values from: Application Installation Event
definition: An event describing changes made to an application, such as updates, reconfigurations, or patch installations, while maintaining its presence on the system.

Approximate String Matching
type: Class
subclass of: Partial Matching
type: NamedIndividual
d3fend-id: D3A-ASM
kb-article: ## References 1. Navarro, G. (2001). A guided tour to approximate string matching. _ACM Computing Surveys_, 33(1), 31-88. [Link](https://doi.org/10.1145/375360.375365)
definition: Approximate string matching is a form of string matching that allows errrors.

Archive File
type: Class
subclass of: File
type: NamedIndividual
definition: An archive file is a file that is composed of one or more computer files along with metadata. Archive files are used to collect multiple data files together into a single file for easier portability and storage, or simply to compress files to use less storage space. Archive files often store directory structures, error detection and correction information, arbitrary comments, and sometimes use built-in encryption.

Artifact
type: Class
subclass of: D3FEND Core
type: NamedIndividual
definition: A man-made object taken as a whole.

Artifact Server
type: Class
subclass of: WebServer
definition: A digital artifact server provides access services to digital artifacts in a repository. It provides an associated set of data management, search and access methods allowing application-independent access to the content.

Artificial Neural Network Classification
type: Class
subclass of: Classification
type: NamedIndividual
d3fend-id: D3A-ANNC
kb-article: ## References ANN Classification. [Link](http://uc-r.github.io/ann_classification).
d3fend-annotation: Classification ANNs seek to classify an observation as belonging to some discrete class as a function of the inputs. The input features (independent variables) can be categorical or numeric types, however, we require a categorical feature as the dependent variable.

Asset Inventory
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Model
type: NamedIndividual
enables: Model
d3fend-id: D3-AI
display-order: 1
synonym: Asset Discovery
synonym: Asset Inventorying
definition: Asset inventorying identifies and records the organization's assets and enriches each inventory item with knowledge about their vulnerabilities.

Asset Inventory Agent
type: Class
subclass of: Network Agent
type: NamedIndividual
definition: An asset inventory agent is a software tool which captures and transmits information about the devices on a network, including their hostnames, MAC addresses, software they may be running, etc.

Asset Vulnerability Enumeration
type: Class
subclass of: Asset Inventory
subclass of: Restriction
  on property: evaluates
  some values from: Physical Artifact
subclass of: Restriction
  on property: evaluates
  some values from: Software
subclass of: Restriction
  on property: identifies
  some values from: Vulnerability
type: NamedIndividual
evaluates: Physical Artifact
evaluates: Software
identifies: Vulnerability
kb-reference: Reference-AutomatedComputerVulnerabilityResolutionSystem
kb-reference: Reference-SecurityVulnerabilityInformationAggregation
kb-reference: Reference-SystemAndMethodForVulnerabilityRiskAssessment
d3fend-id: D3-AVE
definition: Asset vulnerability enumeration enriches inventory items with knowledge identifying their vulnerabilities.

Assign Privileges to Group Event
type: Class
subclass of: Group Management Event
subclass of: Permission Granting Event
subclass of: Restriction
  on property: preceded-by
  some values from: Group Creation Event
definition: An event where specific privileges or rights are granted to a group, enabling its members to perform actions or access resources as defined by the privileges.

Association Rule Learning
type: Class
subclass of: UnsupervisedLearning
type: NamedIndividual
d3fend-id: D3A-ARL
definition: Association rule learning is a rule-based machine learning method for discovering interesting relations between variables in large databases.
kb-article: ## References Association rule learning. (n.d.). Wikipedia. [Link](https://en.wikipedia.org/wiki/Association_rule_learning)

Asymmetric Feature-based Transfer Learning
type: Class
subclass of: Homogenous Transfer Learning
type: NamedIndividual
d3fend-id: D3A-AFTL
definition: Homogeneous (where the metrics are the same for both source and target) asymmetric transformation mapping transforms the source feature space to align with that of the target or the target to that of the source. This, in effect, bridges the feature space gap and reduces the problem into a homogeneous transfer problem when further distribution differences need to be corrected.
kb-article: ## References Day, O., & Khoshgoftaar, T.M. (2017). A survey on heterogeneous transfer learning. Journal of Big Data, 4(1), 29. [Link](https://doi.org/10.1186/s40537-017-0089-0).

Asymmetric Key
type: Class
subclass of: Cryptographic Key
definition: Asymmetric keys are public and private keys, paired such that asymmetric (public-key) cryptography algorithms can be implemented using them. Public-key cryptography, or asymmetric cryptography, is any cryptographic system that uses pairs of keys: public keys that may be disseminated widely paired with private keys which are known only to the owner. There are two functions that can be achieved: using a public key to authenticate that a message originated with a holder of the paired private key; or encrypting a message with a public key to ensure that only the holder of the paired private key can decrypt it.

Attacker
type: Class
subclass of: Agent
definition: An agent that attempts to exploit vulnerabilities to gain unauthorized access to data or systems.

Audio Input Device
type: Class
subclass of: Input Device
type: NamedIndividual
definition: Audio input devices allow a user to send audio info to a computer for processing, recording, or carrying out commands. Devices such as microphones allow users to speak to the computer in order to record a voice message or navigate software. Aside from recording, audio input devices are also used with speech recognition software.

Authenticate User
type: Class
subclass of: System Call
subclass of: Restriction
  on property: authenticates
  some values from: UserAccount
type: NamedIndividual
authenticates: UserAccount

Authentication
type: Class
subclass of: Defensive Action
subclass of: Restriction
  on property: authenticates
  some values from: User
subclass of: Restriction
  on property: may-create
  some values from: Intranet Network Traffic
subclass of: Restriction
  on property: originates-from
  some values from: Physical Location
type: NamedIndividual
definition: A request-response comprising a user credential presentation to a system and a verification response.

Authentication Cache Invalidation
type: Class
subclass of: Credential Eviction
subclass of: Restriction
  on property: deletes
  some values from: Credential
type: NamedIndividual
deletes: Credential
kb-reference: Reference-SecureCachingOfServerCredentials DellProductsLP
kb-reference: Reference-SystemAndMethodForProvidingAnActivelyInvalidatedClient-sideNetworkResourceCache IMVU
d3fend-id: D3-ANCI
definition: Removing tokens or credentials from an authentication cache to prevent further user associated account accesses.
kb-article: ## How it works Applications can locally cache user authentication credentials for certain server connections. An application may attempt to use the cached credential for a connection. If the cached credentials exist then the user will not be typically prompted for new credentials. ## Considerations Are these cached credentials only on the local host? Can they be persisted to the remote server? ## Examples Windows Credential Management API

Authentication Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: caused-by
  some values from: Authentication
subclass of: Restriction
  on property: has-participant
  some values from: Agent
subclass of: Restriction
  on property: has-participant
  some values from: Credential
definition: An event capturing the systematic process of verifying an agent's identity within a system, involving credential validation and identity confirmation.
alternative label: Agent Authentication Event

Authentication Event Thresholding
type: Class
subclass of: UserBehaviorAnalysis
subclass of: Restriction
  on property: analyzes
  some values from: Authentication
type: NamedIndividual
analyzes: Authentication
kb-reference: Reference-MethodAndApparatusForNetworkFraudDetectionAndRemediationThroughAnalytics IdaptiveLLC
kb-reference: Reference-SimultaneousLoginsOnAHost MITRE
kb-reference: Reference-UserLoggedInToMultipleHosts MITRE
kb-reference: Reference-UserLoginActivityMonitoring MITRE
kb-reference: Reference-System,Method,AndComputerProgramProductForDetectingAndAssessingSecurityRisksInANetwork ExabeamInc
date created: 2020-08-05T00:00:00
d3fend-id: D3-ANET
definition: Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile.
kb-article: ## How it works Authentication event data is collected (logon information such as device id, time of day, day of week, geo-location, etc.) to create an activity baseline. Then, a threshold is determined either through a manually specified configuration, or a statistical analysis of deviations in historical data. New authentication events are evaluated to determine if a threshold is exceeded. Thresholds can be static or dynamic. ### Actions As a result of the analysis, actions taken could include: * [Account Locking](/technique/d3f:AccountLocking) * Raising an alert ### Example data sources * Directory server logs * VPN Server logs * IDAM Capability logs * NAC logs * Authentication client logs * Kerberos network traffic * LDAP network traffic ## Considerations This technique covers statistical outliers. Though depending on the complexity or dimensionality of the data considered, outliers may not be obvious to a human analyst reviewing events in simplistic analytic views. If the malicious activity is not statistically different from benign activity, an alert threshold will not be met.

Authentication Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: authenticates
  some values from: UserAccount
type: NamedIndividual
authenticates: UserAccount
definition: Authenticates a user account by verifying a presented credential.

Authentication Log
type: Class
subclass of: Event Log
subclass of: Restriction
  on property: records
  some values from: Authentication
type: NamedIndividual
records: Authentication
definition: A log of authentication events.

Authentication Server
type: Class
subclass of: Server
subclass of: Restriction
  on property: contains
  some values from: Authentication Service Application
subclass of: Restriction
  on property: manages
  some values from: Authentication Service
type: NamedIndividual
contains: Authentication Service Application
manages: Authentication Service
definition: An authentication server provides a network service that applications use to authenticate the credentials, usually account names and passwords, of their users. When a client submits a valid set of credentials, it receives a cryptographic ticket that it can subsequently use to access various services. Major authentication algorithms include passwords, Kerberos, and public key encryption.

Authentication Service
type: Class
subclass of: Service Application Process
subclass of: Restriction
  on property: authenticates
  some values from: Host
type: NamedIndividual
authenticates: Host
definition: An authentication service is a mechanism, analogous to the use of passwords on time-sharing systems, for the secure authentication of the identity of network clients by servers and vice versa, without presuming the operating system integrity of either (e.g., Kerberos).

Authentication Service Application
type: Class
subclass of: Service Application
subclass of: Restriction
  on property: instructs
  some values from: Authentication Service
type: NamedIndividual
instructs: Authentication Service
definition: A software application designed to verify the identity of users or devices.

Authorization
type: Class
subclass of: Defensive Action
subclass of: Restriction
  on property: authorizes
  some values from: Access
type: NamedIndividual
definition: Authorization is the function of specifying access rights to resources related to information security and computer security in general and to access control in particular. More formally, "to authorize" is to define an access policy. For example, human resources staff is normally authorized to access employee records and this policy is usually formalized as access control rules in a computer system. During operation, the system uses the access control rules to decide whether access requests from (authenticated) consumers shall be approved (granted) or disapproved (rejected). Resources include individual files or an item's data, computer programs, computer devices and functionality provided by computer applications. Examples of consumers are computer users, computer program

Authorization Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: caused-by
  some values from: Authorization
subclass of: Restriction
  on property: has-participant
  some values from: Agent
definition: An event reflecting the decision-making process and actions concerning access control, recording whether agents are permitted or denied access to resources based on pre-defined access control policies.

Authorization Event Thresholding
type: Class
subclass of: UserBehaviorAnalysis
subclass of: Restriction
  on property: analyzes
  some values from: Authorization
type: NamedIndividual
analyzes: Authorization
kb-reference: Reference-MethodAndApparatusForNetworkFraudDetectionAndRemediationThroughAnalytics IdaptiveLLC
kb-reference: Reference-SMBSessionSetups MITRE
kb-reference: Reference-UserLoggedInToMultipleHosts MITRE
kb-reference: Reference-System,Method,AndComputerProgramProductForDetectingAndAssessingSecurityRisksInANetwork ExabeamInc
date created: 2020-08-05T00:00:00
d3fend-id: D3-AZET
definition: Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile.
kb-article: ## How it works Authorization event data is collected to create a baseline user profile. Authorization events that deviate from the baseline and exceed a static or dynamic threshold are identified for further action. Authorization events can include successful and failed authorization attempts as well as events related to permissions including viewing, editing, deleting, creating files, databases etc. ## Considerations Depending on the complexity of the data considered, outliers may not be obvious to a human analyst reviewing events in simplistic analytic views. If malicious activity is not statistically different from benign activity, an alert threshold will not be met.

Authorization Log
type: Class
subclass of: Event Log
subclass of: Restriction
  on property: records
  some values from: Network Resource Access
type: NamedIndividual
records: Network Resource Access
definition: A log of authorization events.

Authorization Service
type: Class
subclass of: Network Service
subclass of: Service Application Process
definition: An authorization service ensures that the user is authorized to have access to a particular resource. Authorization can be done through role-based access control (RBAC) or list-based access control (LBAC).

Autoencoding
type: Class
subclass of: Dimension Reduction
type: NamedIndividual
d3fend-id: D3A-AUT
kb-article: ## References SOCR. (n.d.). ABIDE Autoencoder. [Link](https://socr.umich.edu/HTML5/ABIDE_Autoencoder/#:~:text=In%20simple%20words%2C%20autoencoders%20are,layer%20at%20its%20output%20layer.)
definition: Autoencoders are specific type of deep learning architecture used for learning representation of data, typically for the purpose of dimensionality reduction. This is achieved by designing deep learning architecture that aims that copying input layer at its output layer.

Autoregressive Model
type: Class
subclass of: Time Series Analysis
type: NamedIndividual
d3fend-id: D3A-AM
synonym: AR Model
definition: An autoregressive (AR) model is a representation of a type of random process; as such, it is used to describe certain time-varying processes in nature, economics, behavior, etc.
kb-article: ## References Wikipedia. (n.d.). Autoregressive model. [Link](https://en.wikipedia.org/wiki/Autoregressive_model)

Average Absolute Deviation
type: Class
subclass of: Variability
type: NamedIndividual
d3fend-id: D3A-AAD
definition: The average absolute deviation (AAD) of a data set is the average of the absolute deviations from a central point.
kb-article: ## References Wikipedia. (n.d.). Average absolute deviation. [Link](https://en.wikipedia.org/wiki/Average_absolute_deviation)

BERT
type: Class
subclass of: Transformer-basedLearning
type: NamedIndividual
d3fend-id: D3A-BER
synonym: Bidirectional Encoder Representations from Transformers
definition: Bidirectional Encoder Representations from Transformers (BERT) is based on a deep learning model in which every output element is connected to every input element, and the weightings between them are dynamically calculated based upon their connection.
kb-article: ## References BERT (language model). (n.d.). In TechTarget. [Link](https://www.techtarget.com/searchenterpriseai/definition/BERT-language-model) BERT (language model). (n.d.). In Wikipedia. [Link](https://en.wikipedia.org/wiki/BERT_(language_model))

Barcode Scanner Input Device
type: Class
subclass of: Image Scanner Input Device
definition: A barcode reader (or barcode scanner) is an optical scanner that can read printed barcodes, decode the data contained in the barcode and send the data to a computer. Like a flatbed scanner, it consists of a light source, a lens and a light sensor translating for optical impulses into electrical signals. Additionally, nearly all barcode readers contain decoder circuitry that can analyze the barcode's image data provided by the sensor and sending the barcode's content to the scanner's output port.
alternative label: Barcode Reader

Bayes Optimal Classifier
type: Class
subclass of: Ensemble Learning
type: NamedIndividual
d3fend-id: D3A-BOC
definition: A probabilistic model that makes the most probable prediction for a new example.
kb-article: ## References Bayes Optimal Classifier. Machine Learning Mastery. [Link](https://machinelearningmastery.com/bayes-optimal-classifier/). Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).

Bayesian Estimation
type: Class
subclass of: Bayesian Method
type: NamedIndividual
d3fend-id: D3A-BE
kb-article: ## References Wikipedia. (n.d.). Bayes estimator. [Link](https://en.wikipedia.org/wiki/Bayes_estimator)
definition: A Bayes estimator or a Bayes action is an estimator or decision rule that minimizes the posterior expected value of a loss function (i.e., the posterior expected loss).

Bayesian Hypothesis Testing
type: Class
subclass of: Bayesian Method
type: NamedIndividual
d3fend-id: D3A-BHT
definition: Bayesian hypothesis testing can be framed as a special case of model comparison where a model refers to a likelihood function and a prior distribution.
kb-article: ## How it works Given two competing hypotheses and some relevant data, Bayesian hypothesis testing begins by specifying separate prior distributions to quantitatively describe each hypothesis. The combination of the likelihood function for the observed data with each of the prior distributions yields hypothesis-specific models. For each of the hypothesis-specific models, averaging (ie, integrating) the likelihood with respect to the prior distribution across the entire parameter space yields the probability of the data under the model and, therefore, the corresponding hypothesis. This quantity is more commonly referred to as the marginal likelihood and represents the average fit of the model to the data. The ratio of the marginal likelihoods for both hypothesis-specific models is known as the Bayes factor. ## References Baig, S. A., PhD. (2020). Bayesian Inference: An Introduction to Hypothesis Testing Using Bayes Factors. Nicotine & Tobacco Research, 22(7), 1244-1246. [Link](https://academic.oup.com/ntr/article/22/7/1244/5613971)

Bayesian Linear Regression
type: Class
subclass of: Regression Analysis
type: NamedIndividual
d3fend-id: D3A-BLR
definition: Bayesian linear regression is a type of conditional modeling in which the mean of one variable is described by a linear combination of other variables, with the goal of obtaining the posterior probability of the regression coefficients.
kb-article: ## References Wikipedia. (n.d.). Bayesian linear regression. [Link](https://en.wikipedia.org/wiki/Bayesian_linear_regression)

Bayesian Linear Regression Learning
type: Class
subclass of: Regression Analysis Learning
type: NamedIndividual
d3fend-id: D3A-BLRL
definition: A supervised learning method that builds a Bayesian linear regression model using training data.
kb-article: ## References Wikipedia. (n.d.). Bayesian linear regression. [Link](https://en.wikipedia.org/wiki/Bayesian_linear_regression)

Bayesian Method
type: Class
subclass of: Statistical Method
type: NamedIndividual
d3fend-id: D3A-BM
definition: Bayesian analysis is a statistical procedure which endeavors to estimate parameters of an underlying distribution based on the observed distribution.
kb-article: ## References Wolfram MathWorld. (n.d.). Bayesian Analysis. [Link](https://mathworld.wolfram.com/BayesianAnalysis.html)

Bayesian Model Averaging
type: Class
subclass of: Ensemble Learning
type: NamedIndividual
d3fend-id: D3A-BMA
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning). Bayesian model average: A parameter estimation approach to model agnostic ensemble learning. (2019). Journal of Machine Learning for Modeling and Computing, 1(2), 61-70. [Link](https://journals.sagepub.com/doi/full/10.1177/2515245919898657#:~:text=Bayesian%20model%20average%3A%20A%20parameter,weighted%20by%20its%20model%20probability).
definition: A parameter estimate (or a prediction of new observations) obtained by averaging the estimates (or predictions) of the different models under consideration, each weighted by its model probability.

Bayesian Model Combination
type: Class
subclass of: Ensemble Learning
type: NamedIndividual
d3fend-id: D3A-BMC
definition: Bayesian model combination (BMC) is an algorithmic correction to Bayesian model averaging (BMA). Instead of sampling each model in the ensemble individually, it samples from the space of possible ensembles (with model weights drawn randomly from a Dirichlet distribution having uniform parameters)
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning). Shultz, K. M., & Peterson, L. E. (2011). Model-averaged confidence intervals for ensemble learning. In *International Joint Conference on Neural Networks* (pp. 2677-2684). [Link](https://axon.cs.byu.edu/papers/Kristine.ijcnn2011.pdf).

Binary Classification
type: Class
subclass of: Classifying

Binary Large Object
type: Class
subclass of: Digital Information Bearer
definition: A binary large object (BLOB) is a collection of binary data stored as a single entity. Blobs are typically images, audio or other multimedia objects, though sometimes binary executable code is stored as a blob.
alternative label: BLOB
alternative label: Blob

Binary Segment
type: Class
subclass of: Digital Information Bearer
definition: A binary segment is a partition of binary information within a larger binary object, which arranges a set of binary objects for its purpose. For example, code, data, heap, and stack segments are segments of the binary information used by a process. Code and data segments are also found in object files.

Biometric Authentication
type: Class
subclass of: Agent Authentication
subclass of: Restriction
  on property: authenticates
  some values from: Person
type: NamedIndividual
authenticates: Person
kb-reference: Reference-TokenlessBiometricTransactionAuthorizationMethodAndSystem
kb-reference: Reference-www.biometric-solutions.com keystroke-dynamics
d3fend-id: D3-BAN
definition: Using biological measures in order to authenticate a user.

Bitmap Image
type: Class
subclass of: Digital Image
type: NamedIndividual
definition: A graphical image whose data is stored in a grid format.

Bitmap Image File
type: Class
subclass of: Image File
subclass of: Restriction
  on property: contains
  some values from: Bitmap Image
type: NamedIndividual
contains: Bitmap Image
definition: A file that contains graphics data represented in a bitmap.

Block Device
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Boot Sector
subclass of: Restriction
  on property: contains
  some values from: Partition
subclass of: Restriction
  on property: contains
  some values from: Partition Table
subclass of: Restriction
  on property: may-contain
  some values from: Volume
type: NamedIndividual
contains: Boot Sector
contains: Partition
contains: Partition Table
may-contain: Volume
definition: A block device (or block special file) provides buffered access to hardware devices, and provides some abstraction from their specifics. IEEE Std 1003.1-2017: A file that refers to a device. A block special file is normally distinguished from a character special file by providing access to the device in a manner such that the hardware characteristics of the device are not visible.
alternative label: Block Special File

Book Reference
type: Class
subclass of: Technique Reference
pref-label: Book

Boolean Expression Matching
type: Class
subclass of: Logical Rules
type: NamedIndividual
d3fend-id: D3A-BEM
definition: Boolean expression matching produces a Boolean truth value for a given boolean expression and assignment of values to variables in the expression.
kb-article: ## How it works A Boolean expression is an expression used in programming languages that produces a Boolean value when evaluated. A Boolean value is either true or false. A Boolean expression may be composed of a combination of the Boolean constants true or false, Boolean-typed variables, Boolean-valued operators, and Boolean-valued functions. Boolean expressions correspond to propositional formulas in logic and are a special case of Boolean circuits. ## References 1. Boolean expression. (2022, April 25). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Boolean_expression) 2. Boolean algebra. (2022, May 19). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Boolean_expression)

Boosting
type: Class
subclass of: Ensemble Learning
type: NamedIndividual
d3fend-id: D3A-BOO
kb-article: ## How it works Boosting consists of using sequentially weak learners where each iteration’s training focuses on previously misclassified instances in order to improve on the previous iteration. This process is continued iteratively until the final prediction is made by aggregating the previous predictions. ## Considerations Boosting can be computationally expensive, prone to overfitting, and slower to train compared to other ensemble methods. There are three main types of Boosting algorithms - Adaptive Boosting Adaptive Boosting (sometimes called AdaBoost) works by adding equal importance to each piece of a dataset and running it through the base learning algorithms. Every algorithm that errors, the boosting algorithm assigns a higher importance to. This continues until an acceptable level of confidence is reached. - Gradient Boosting Gradient Boosting starts by training multiple models simultaneously to gather a strong estimate of strength to build new base learning algorithms. - XGBoosting XGBoosting is a scalable tree boosting model. Using decision trees, weight is assigned to each variable and put into a decision tree. Outputs that are classified by the algorithm as wrong or weak are put into a second decision tree and the results form a stronger model. ## References Sciencedirect. (n.d.). Semi-supervised learning: An overview. [Link](https://www.sciencedirect.com/science/article/pii/S1319157823000228)
definition: Boosting is a sequential process where each subsequent model attempts to correct the errors of the previous model

Boot Loader
type: Class
subclass of: Software
type: NamedIndividual
alternative label: Bootloader
definition: A bootloader is software that is responsible for booting a computer. When a computer is turned off, its software‍-‌including operating systems, application code, and data‍-‌remains stored on non-volatile memory. When the computer is powered on, it typically does not have an operating system or its loader in random-access memory (RAM). The computer first executes a relatively small program stored in read-only memory (ROM, and later EEPROM, NOR flash) along with some needed data, to initialize RAM (especially on x86 systems) to access the nonvolatile device (usually block device, eg NAND flash) or devices from which the operating system programs and data can be loaded into RAM.

Boot Record
type: Class
subclass of: Record
type: NamedIndividual
definition: A d3f:Record which is an essential component of the early boot (system initialization) process.

Boot Sector
type: Class
subclass of: Boot Record
type: NamedIndividual
definition: A boot record [boot sector] is the sector of a persistent data storage device (e.g., hard disk, floppy disk, optical disc, etc.) which contains machine code to be loaded into random-access memory (RAM) and then executed by a computer system's built-in firmware (e.g., the BIOS, Das U-Boot, etc.).

Bootloader Authentication
type: Class
subclass of: Platform Hardening
subclass of: Restriction
  on property: authenticates
  some values from: Boot Loader
type: NamedIndividual
authenticates: Boot Loader
kb-reference: Reference-UEFIPlatformInitialization-Specification
d3fend-id: D3-BA
definition: Cryptographically authenticating the bootloader software before system boot.
synonym: Secure Boot

Bootstrap Aggregating
type: Class
subclass of: Resampling Ensemble
type: NamedIndividual
d3fend-id: D3A-BA
kb-article: ## References Bootstrap aggregating. Wikipedia. [Link](https://en.wikipedia.org/wiki/Bootstrap_aggregating).
definition: Bootstrap aggregating, also called bagging (from bootstrap aggregating), is a machine learning ensemble meta-algorithm designed to improve the stability and accuracy of machine learning algorithms used in statistical classification and regression. It also reduces variance and helps to avoid overfitting. Although it is usually applied to decision tree methods, it can be used with any type of method. Bagging is a special case of the model averaging approach.

Broadcast Domain Isolation
type: Class
subclass of: Network Isolation
subclass of: Restriction
  on property: filters
  some values from: Local Area Network Traffic
type: NamedIndividual
filters: Local Area Network Traffic
kb-reference: Reference-PrivateVirtualLocalAreaNetworkIsolation CiscoTechnologyInc
d3fend-id: D3-BDI
synonym: Network Segmentation
definition: Broadcast isolation restricts the number of computers a host can contact on their LAN.
kb-article: ## How it works Software Defined Networking, or other network encapsulation technologies intercept host broadcast traffic then route it to a specified destination per a configured policy. This can be implemented within hypervisors, networking hardware (WAPs, switches, routers), or virutal hardware. ## Considerations This technique is highly dependent on network infrastructure and networking requirements.

Browser
type: Class
subclass of: UserApplication
subclass of: Restriction
  on property: may-contain
  some values from: Browser Extension
type: NamedIndividual
may-contain: Browser Extension
definition: A web browser (commonly referred to as a browser) is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier (URI/URL) and may be a web page, image, video or other piece of content. Hyperlinks present in resources enable users easily to navigate their browsers to related resources. Although browsers are primarily intended to use the World Wide Web, they can also be used to access information provided by web servers in private networks or files in file systems.

Browser Extension
type: Class
subclass of: UserApplication
subclass of: Restriction
  on property: extends
  some values from: Browser
type: NamedIndividual
extends: Browser
definition: A browser extension is a plug-in that extends the functionality of a web browser in some way. Some extensions are authored using web technologies such as HTML, JavaScript, and CSS. Browser extensions can change the user interface of the web browser without directly affecting viewable content of a web page; for example, by adding a "toolbar."

Bucket of Models
type: Class
subclass of: Ensemble Learning
type: NamedIndividual
d3fend-id: D3A-BOM
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).
definition: A "bucket of models" is an ensemble technique in which a model selection algorithm is used to choose the best model for each problem. When tested with only one problem, a bucket of models can produce no better results than the best model in the set, but when evaluated across many problems, it will typically produce much better results, on average, than any model in the set.

Build Tool
type: Class
subclass of: Developer Application
definition: A tool that automates the process of creating a software build and the associated processes including: compiling computer source code into binary code, packaging binary code, and running automated tests.
alternative label: Build Automation Tool

Bus Message
type: Class
subclass of: Digital Message
type: NamedIndividual
definition: A digital message potentially containing commands, telemetry, or status signals, encoded in a bus protocol and conveyed over a bus within one or more frames.

Bus Network
type: Class
subclass of: Network
type: NamedIndividual
alternative label: Data Highway
alternative label: Bus
definition: An electronic communication system that links multiple components through one shared transmission medium, together with the interface hardware and link-layer signalling that govern access to that medium.

Bus Network Frame
type: Class
subclass of: Network Frame
subclass of: Restriction
  on property: contained-by
  some values from: Bus Network Traffic
subclass of: Restriction
  on property: contains
  some values from: Bus Message
type: NamedIndividual
contained-by: Bus Network Traffic
contains: Bus Message
alternative label: Bus Frame
definition: A network frame whose layout and timing follow a bus protocol, allowing data to be exchanged across the shared bus medium.

Bus Network Node
type: Class
subclass of: Host
subclass of: Restriction
  on property: connected-to
  some values from: Bus Network
subclass of: Restriction
  on property: transmits
  some values from: Bus Network Traffic
type: NamedIndividual
connected-to: Bus Network
transmits: Bus Network Traffic
definition: A device or logical endpoint whose interface is directly connected to a bus and exchanges data over the shared medium using the protocol implemented on that interface.

Bus Network Traffic
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Bus Network Frame
type: NamedIndividual
contains: Bus Network Frame
definition: The ordered flow of frames, structured by a bus protocol, that traverses the shared bus medium during operation.

Business Communication Platform Client
type: Class
subclass of: Collaborative Software
definition: Client software to enable the process of sharing information between employees within and outside a company. Business communication encompasses topics such as marketing, brand management, customer relations, consumer behavior, advertising, public relations, corporate communication, community engagement, reputation management, interpersonal communication, employee engagement, and event management. It is closely related to the fields of professional communication and technical communication.

Byte Sequence Emulation
type: Class
subclass of: Network Traffic Analysis
type: NamedIndividual
kb-reference: Reference-Network-BasedBufferOverflowDetectionByExploitCodeAnalysis InformationSecurityResearchCentre
kb-reference: Reference-Network-levelPolymorphicShellcodeDetectionUsingEmulation
d3fend-id: D3-BSE
definition: Analyzing sequences of bytes and determining if they likely represent malicious shellcode.
kb-article: ## How it works Bytes are analyzed as if they are machine code instructions, and such instructions that are a common component of known shellcode are noted, such as stack pivots, reads from a Memory Address Table, and system calls for functions that disable protections or execute code. For example, the x86 instruction `b0 0b: mov $11, %ax`, with no further alterations to the `%ax` register, followed by `cd 80: syscall` executes the system call `execve()` in the Linux kernel, which replaces the current process with another one specified -- this is a common action in shellcode, so this sequence would be flagged. This technique detects shellcode despite whether or not it would cause a buffer overflow in the target binary. If the sequence of bytes contains a sequence similar to that used in malicious shellcode, the entire byte sequence is flagged and a follow-on technique may be invoked. ## Considerations ### False Negatives If the shellcode instructions are far apart, simple implementations might not detect the shellcode. Due to the nature of assembly instructions not having a defined start or end, implementations which do not process all start sequences (for example, when they a find byte sequence of interest, continue scanning forwards from the end of it) might not detect the shellcode. This technique might not detect more complex or obfuscated instructions. For that purpose, Dynamic Analysis or Emulated File Analysis could assist by analyzing the actual instruction function. This technique may not detect self-modifying code. To make it harder for a process to modify itself, Process Segment Execution Prevention should be used, while noting its considerations. This technique might not detect malicious shellcode which reuses instructions in the target binary for malicious effect, as memory references in the presumed assembly code are not dereferenced. Dynamic Analysis and Emulated File Analysis, when set up properly to fork from the running target binary, might detect …
synonym: Shellcode Transmission Detection

C4.5
type: Class
subclass of: Decision Tree
type: NamedIndividual
d3fend-id: D3A-C4.
definition: C4.5 is an algorithm that is strongly based off ID3. It creates decision trees the same way as ID3. C4.5 improves on several aspects of ID3, including handling discreet variables, handling training data with missing values, and has the ability to automatically prune the decision trees it creates.
kb-article: ## References C4.5 algorithm. Wikipedia. [Link](https://en.wikipedia.org/wiki/C4.5_algorithm).

C5.0
type: Class
subclass of: Decision Tree
type: NamedIndividual
d3fend-id: D3A-C5.
kb-article: ## References C4.5 algorithm. Wikipedia. [Link](https://en.wikipedia.org/wiki/C4.5_algorithm).
definition: C5.0 is the next version of C4.5, which in turn is the upgrade from ID3. The only difference between C5.0 and C4.5 is some improvements made to C5.0.

CA Certificate File
type: Class
subclass of: Certificate File
definition: A file containing a digital certificate issued by a certificate authority (CA). Certificate authorities store, issue, and sign digital certificates used as part of the public key infrastructure.

Exploitation of Transient Instruction Execution
type: Class
subclass of: Common Attack Pattern
type: NamedIndividual
type: Common Attack Pattern
capec-id: CAPEC-553

CAPEC Thing
type: Class
subclass of: External Threat Model Thing

CART
type: Class
subclass of: Decision Tree
type: NamedIndividual
d3fend-id: D3A-CAR
definition: The CART algorithm is a type of classification algorithm that is required to build a decision tree on the basis of Gini’s impurity index.
kb-article: ## References Classification and Regression Tree (CART) Algorithm. Analytics Steps. [Link](https://www.analyticssteps.com/blogs/classification-and-regression-tree-cart-algorithm).

CCI Control
type: Class
subclass of: External Control
subclass of: Restriction
  on property: member-of
  some values from: Control Correlation Identifier Catalog
subclass of: Restriction
  on property: control-name
  some values from: string
subclass of: Restriction
  on property: date published
  some values from: dateTime

Sensitive Cookie Without 'HttpOnly' Flag
type: Class
subclass of: Incorrect Permission Assignment for Critical Resource
cwe-id: CWE-1004
definition: The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Insufficient Visual Distinction of Homoglyphs Presented to User
type: Class
subclass of: User Interface (UI) Misrepresentation of Critical Information
cwe-id: CWE-1007
definition: The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.
synonym: Homograph Attack

Struts: Duplicate Validation Forms
type: Class
subclass of: Improper Use of Validation Framework
subclass of: Use of Multiple Resources with Duplicate Identifier
cwe-id: CWE-102
definition: The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect.

Improper Restriction of Rendered UI Layers or Frames
type: Class
subclass of: Unintended Proxy or Intermediary ('Confused Deputy')
subclass of: User Interface (UI) Misrepresentation of Critical Information
cwe-id: CWE-1021
definition: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
synonym: Clickjacking
synonym: Tapjacking
synonym: UI Redress Attack

Use of Web Link to Untrusted Target with window.opener Access
type: Class
subclass of: Incorrect Privilege Assignment
cwe-id: CWE-1022
definition: The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.
synonym: tabnabbing

Incomplete Comparison with Missing Factors
type: Class
subclass of: Incorrect Comparison
cwe-id: CWE-1023
definition: The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Comparison of Incompatible Types
type: Class
subclass of: Incorrect Comparison
cwe-id: CWE-1024
definition: The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.

Comparison Using Wrong Factors
type: Class
subclass of: Incorrect Comparison
cwe-id: CWE-1025
definition: The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Struts: Incomplete validate() Method Definition
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-103
definition: The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().

Processor Optimization Removal or Modification of Security-critical Code
type: Class
subclass of: Insecure Automated Optimizations
cwe-id: CWE-1037
definition: The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.

Insecure Automated Optimizations
type: Class
subclass of: Improper Interaction Between Multiple Correctly-Behaving Entities
subclass of: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe-id: CWE-1038
definition: The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.

Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations
type: Class
subclass of: Protection Mechanism Failure
subclass of: Incorrect Comparison
cwe-id: CWE-1039
definition: The product uses an automated mechanism such as machine learning to recognize complex data inputs (e.g. image or audio) as a particular concept or category, but it does not properly detect or handle inputs that have been modified or constructed in a way that causes the mechanism to detect a different, incorrect concept.
label: Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism

Struts: Form Bean Does Not Extend Validation Class
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-104
definition: If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.

Use of Redundant Code
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1041
definition: The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

Static Member Data Element outside of a Singleton Class Element
type: Class
subclass of: Inefficient CPU Computation
cwe-id: CWE-1042
definition: The code contains a member element that is declared as static (but not final), in which its parent class element is not a singleton class - that is, a class element that can be used only once in the 'to' association of a Create action.

Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
type: Class
subclass of: Excessively Complex Data Representation
cwe-id: CWE-1043
definition: The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects.

Architecture with Number of Horizontal Layers Outside of Expected Range
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1044
definition: The product's architecture contains too many - or too few - horizontal layers.

Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-1045
definition: A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.

Creation of Immutable Text Using String Concatenation
type: Class
subclass of: Inefficient CPU Computation
cwe-id: CWE-1046
definition: The product creates an immutable text string using string concatenation operations.

Modules with Circular Dependencies
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1047
definition: The product contains modules in which one module has references that cycle back to itself, i.e., there are circular dependencies.

Invokable Control Element with Large Number of Outward Calls
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1048
definition: The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.

Excessive Data Query Operations in a Large Data Table
type: Class
subclass of: Inefficient CPU Computation
cwe-id: CWE-1049
definition: The product performs a data query with a large number of joins and sub-queries on a large data table.

Struts: Form Field Without Validator
type: Class
subclass of: Improper Use of Validation Framework
cwe-id: CWE-105
definition: The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.

Excessive Platform Resource Consumption within a Loop
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-1050
definition: The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

Initialization with Hard-Coded Network Resource Configuration Data
type: Class
subclass of: Incorrect Initialization of Resource
subclass of: Improper Initialization
cwe-id: CWE-1051
definition: The product initializes data using hard-coded values that act as network resource identifiers.

Excessive Use of Hard-Coded Literals in Initialization
type: Class
subclass of: Incorrect Initialization of Resource
subclass of: Improper Initialization
cwe-id: CWE-1052
definition: The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element.

Missing Documentation for Design
type: Class
subclass of: Insufficient Technical Documentation
cwe-id: CWE-1053
definition: The product does not have documentation that represents how it is designed.

Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
type: Class
subclass of: Insufficient Encapsulation
cwe-id: CWE-1054
definition: The code at one architectural layer invokes code that resides at a deeper layer than the adjacent layer, i.e., the invocation skips at least one layer, and the invoked code is not part of a vertical utility layer that can be referenced from any horizontal layer.

Multiple Inheritance from Concrete Classes
type: Class
subclass of: Excessively Complex Data Representation
cwe-id: CWE-1055
definition: The product contains a class with inheritance from more than one concrete class.

Invokable Control Element with Variadic Parameters
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1056
definition: A named-callable or method control element has a signature that supports a variable (variadic) number of parameters or arguments.

Data Access Operations Outside of Expected Data Manager Component
type: Class
subclass of: Insufficient Encapsulation
cwe-id: CWE-1057
definition: The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.

Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
type: Class
subclass of: Improper Synchronization
cwe-id: CWE-1058
definition: The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element.

Insufficient Technical Documentation
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1059
definition: The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.

Struts: Plug-in Framework not in Use
type: Class
subclass of: Improper Use of Validation Framework
cwe-id: CWE-106
definition: When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.

Excessive Number of Inefficient Server-Side Data Accesses
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1060
definition: The product performs too many data queries without using efficient data processing functionality such as stored procedures.

Insufficient Encapsulation
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1061
definition: The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.

Parent Class with References to Child Class
type: Class
subclass of: Insufficient Encapsulation
cwe-id: CWE-1062
definition: The code has a parent class that contains references to a child class, its methods, or its members.

Creation of Class Instance within a Static Code Block
type: Class
subclass of: Inefficient CPU Computation
cwe-id: CWE-1063
definition: A static code block creates an instance of a class.

Invokable Control Element with Signature Containing an Excessive Number of Parameters
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1064
definition: The product contains a function, subroutine, or method whose signature has an unnecessarily large number of parameters/arguments.

Runtime Resource Management Control Element in a Component Built to Run on Application Servers
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1065
definition: The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.

Missing Serialization Control Element
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1066
definition: The product contains a serializable data element that does not have an associated serialization method.

Excessive Execution of Sequential Searches of Data Resource
type: Class
subclass of: Inefficient CPU Computation
cwe-id: CWE-1067
definition: The product contains a data query against an SQL table or view that is configured in a way that does not utilize an index and may cause sequential searches to be performed.

Inconsistency Between Implementation and Documented Design
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1068
definition: The implementation of the product is not consistent with the design as described within the relevant documentation.

Empty Exception Block
type: Class
subclass of: Empty Code Block
cwe-id: CWE-1069
definition: An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.

Struts: Unused Validation Form
type: Class
subclass of: Irrelevant Code
cwe-id: CWE-107
definition: An unused validation form indicates that validation logic is not up-to-date.

Serializable Data Element Containing non-Serializable Item Elements
type: Class
subclass of: Insufficient Adherence to Expected Conventions
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1070
definition: The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable.

Empty Code Block
type: Class
subclass of: Irrelevant Code
cwe-id: CWE-1071
definition: The source code contains a block that does not contain any code, i.e., the block is empty.

Data Resource Access without Use of Connection Pooling
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-1072
definition: The product accesses a data resource through a database without using a connection pooling capability.

Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-1073
definition: The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.

Class with Excessively Deep Inheritance
type: Class
subclass of: Excessively Complex Data Representation
cwe-id: CWE-1074
definition: A class has an inheritance level that is too high, i.e., it has a large number of parent classes.

Unconditional Control Flow Transfer outside of Switch Block
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1075
definition: The product performs unconditional control transfer (such as a "goto") in code outside of a branching structure such as a switch block.

Insufficient Adherence to Expected Conventions
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1076
definition: The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.

Floating Point Comparison with Incorrect Operator
type: Class
subclass of: Incorrect Comparison
cwe-id: CWE-1077
definition: The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.

Inappropriate Source Code Style or Formatting
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-1078
definition: The source code does not follow desired style or formatting for indentation, white space, comments, etc.

Parent Class without Virtual Destructor Method
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-1079
definition: A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

Struts: Unvalidated Action Form
type: Class
subclass of: Improper Use of Validation Framework
cwe-id: CWE-108
definition: Every Action Form must have a corresponding validation form.

Source Code File with Excessive Number of Lines of Code
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1080
definition: A source code file has too many lines of code.

Class Instance Self Destruction Control Element
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-1082
definition: The code contains a class instance that calls the method or function to delete or destroy itself.

Data Access from Outside Expected Data Manager Component
type: Class
subclass of: Insufficient Encapsulation
cwe-id: CWE-1083
definition: The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component.

Invokable Control Element with Excessive File or Data Access Operations
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-1084
definition: A function or method contains too many operations that utilize a data manager or file resource.

Invokable Control Element with Excessive Volume of Commented-out Code
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1085
definition: A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body.

Class with Excessive Number of Child Classes
type: Class
subclass of: Excessively Complex Data Representation
cwe-id: CWE-1086
definition: A class contains an unnecessarily large number of children.

Class with Virtual Method without a Virtual Destructor
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-1087
definition: A class contains a virtual method, but the method does not have an associated virtual destructor.

Synchronous Access of Remote Resource without Timeout
type: Class
subclass of: Incorrect Synchronization
cwe-id: CWE-1088
definition: The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.

Large Data Table with Excessive Number of Indices
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-1089
definition: The product uses a large data table that contains an excessively large number of indices.

Struts: Validator Turned Off
type: Class
subclass of: Improper Use of Validation Framework
cwe-id: CWE-109
definition: Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.

Method Containing Access of a Member Element from Another Class
type: Class
subclass of: Insufficient Encapsulation
cwe-id: CWE-1090
definition: A method for a class performs an operation that directly accesses a member element from another class.

Use of Object without Invoking Destructor Method
type: Class
subclass of: Insufficient Adherence to Expected Conventions
subclass of: Missing Release of Resource after Effective Lifetime
cwe-id: CWE-1091
definition: The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method.

Use of Same Invokable Control Element in Multiple Architectural Layers
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1092
definition: The product uses the same control element across multiple architectural layers.

Excessively Complex Data Representation
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1093
definition: The product uses an unnecessarily complex internal representation for its data structures or interrelationships between those structures.

Excessive Index Range Scan for a Data Resource
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-1094
definition: The product contains an index range scan for a large data table, but the scan can cover a large number of rows.

Loop Condition Value Update within the Loop
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1095
definition: The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.

Singleton Class Instance Creation without Proper Locking or Synchronization
type: Class
subclass of: Missing Synchronization
cwe-id: CWE-1096
definition: The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once.

Persistent Storable Data Element without Associated Comparison Control Element
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-1097
definition: The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison.

Data Element containing Pointer Item without Proper Copy Control Element
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-1098
definition: The code contains a data element with a pointer that does not have an associated copy or constructor method.

Inconsistent Naming Conventions for Identifiers
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1099
definition: The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements.

ASP.NET Misconfiguration: Creating Debug Binary
type: Class
subclass of: Active Debug Code
cwe-id: CWE-11
definition: Debugging messages help attackers learn about the system and plan a form of attack.

Struts: Validator Without Form Field
type: Class
subclass of: Irrelevant Code
cwe-id: CWE-110
definition: Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.

Insufficient Isolation of System-Dependent Functions
type: Class
subclass of: Insufficient Encapsulation
cwe-id: CWE-1100
definition: The product or code does not isolate system-dependent functionality into separate standalone modules.

Reliance on Runtime Component in Generated Code
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1101
definition: The product uses automatically-generated code that cannot be executed without a specific runtime support component.

Reliance on Machine-Dependent Data Representation
type: Class
subclass of: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe-id: CWE-1102
definition: The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, physical machines, OSes, or other physical components.

Use of Platform-Dependent Third Party Components
type: Class
subclass of: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe-id: CWE-1103
definition: The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.

Use of Unmaintained Third Party Components
type: Class
subclass of: Reliance on Insufficiently Trustworthy Component
cwe-id: CWE-1104
definition: The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

Insufficient Encapsulation of Machine-Dependent Functionality
type: Class
subclass of: Insufficient Encapsulation
subclass of: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe-id: CWE-1105
definition: The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.

Insufficient Use of Symbolic Constants
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1106
definition: The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.

Insufficient Isolation of Symbolic Constant Definitions
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1107
definition: The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.

Excessive Reliance on Global Variables
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-1108
definition: The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.

Use of Same Variable for Multiple Purposes
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1109
definition: The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.

Direct Use of Unsafe JNI
type: Class
subclass of: Use of Low-Level Functionality
cwe-id: CWE-111
definition: When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.

Incomplete Design Documentation
type: Class
subclass of: Insufficient Technical Documentation
cwe-id: CWE-1110
definition: The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, components, rationales, or other important aspects of the design.

Incomplete I/O Documentation
type: Class
subclass of: Insufficient Technical Documentation
cwe-id: CWE-1111
definition: The product's documentation does not adequately define inputs, outputs, or system/software interfaces.

Incomplete Documentation of Program Execution
type: Class
subclass of: Insufficient Technical Documentation
cwe-id: CWE-1112
definition: The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.

Inappropriate Comment Style
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1113
definition: The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.

Inappropriate Whitespace Style
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1114
definition: The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

Source Code Element without Standard Prologue
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1115
definition: The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.

Inaccurate Comments
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1116
definition: The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.

Callable with Insufficient Behavioral Summary
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-1117
definition: The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, side effects, assumptions, or return codes.

Insufficient Documentation of Error Handling Techniques
type: Class
subclass of: Insufficient Technical Documentation
cwe-id: CWE-1118
definition: The documentation does not sufficiently describe the techniques that are used for error handling, exception processing, or similar mechanisms.

Excessive Use of Unconditional Branching
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1119
definition: The code uses too many unconditional branches (such as "goto").

Missing XML Validation
type: Class
subclass of: Improper Validation of Syntactic Correctness of Input
cwe-id: CWE-112
definition: The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

Excessive Code Complexity
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1120
definition: The code is too complex, as calculated using a well-defined, quantitative measure.

Excessive McCabe Cyclomatic Complexity
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1121
definition: The code contains McCabe cyclomatic complexity that exceeds a desirable maximum.

Excessive Halstead Complexity
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1122
definition: The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.

Excessive Use of Self-Modifying Code
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1123
definition: The product uses too much self-modifying code.

Excessively Deep Nesting
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1124
definition: The code contains a callable or other code grouping in which the nesting / branching is too deep.

Excessive Attack Surface
type: Class
subclass of: Excessive Code Complexity
cwe-id: CWE-1125
definition: The product has an attack surface whose quantitative measurement exceeds a desirable maximum.

Declaration of Variable with Unnecessarily Wide Scope
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1126
definition: The source code declares a variable in one scope, but the variable is only used within a narrower scope.

Compilation with Insufficient Warnings or Errors
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1127
definition: The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues.

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
type: Class
subclass of: Interpretation Conflict
subclass of: Improper Neutralization of CRLF Sequences ('CRLF Injection')
cwe-id: CWE-113
definition: The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
synonym: HTTP Request Splitting
synonym: HTTP Response Splitting

Process Control
type: Class
subclass of: External Control of File Name or Path
cwe-id: CWE-114
definition: Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

Misinterpretation of Input
type: Class
subclass of: Interpretation Conflict
cwe-id: CWE-115
definition: The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

Improper Encoding or Escaping of Output
type: Class
subclass of: Improper Neutralization
cwe-id: CWE-116
definition: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
synonym: Output Encoding
synonym: Output Sanitization
synonym: Output Validation

Irrelevant Code
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1164
definition: The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

Improper Output Neutralization for Logs
type: Class
subclass of: Improper Encoding or Escaping of Output
cwe-id: CWE-117
definition: The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
synonym: Log forging

Improper Use of Validation Framework
type: Class
subclass of: Improper Input Validation
cwe-id: CWE-1173
definition: The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.

ASP.NET Misconfiguration: Improper Model Validation
type: Class
subclass of: Improper Use of Validation Framework
cwe-id: CWE-1174
definition: The ASP.NET application does not use, or incorrectly uses, the model validation framework.

Inefficient CPU Computation
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-1176
definition: The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.

Use of Prohibited Code
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1177
definition: The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.

Incorrect Access of Indexable Resource ('Range Error')
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-118
definition: The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Initialization of a Resource with an Insecure Default
type: Class
subclass of: Incorrect Initialization of Resource
subclass of: Improper Initialization
cwe-id: CWE-1188
definition: The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
label: Insecure Default Initialization of Resource

Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
type: Class
subclass of: Improper Isolation or Compartmentalization
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-1189
definition: The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.

Improper Restriction of Operations within the Bounds of a Memory Buffer
type: Class
subclass of: Incorrect Access of Indexable Resource ('Range Error')
subclass of: Restriction
  on property: weakness-of
  some values from: Raw Memory Access Function
type: NamedIndividual
weakness-of: Raw Memory Access Function
cwe-id: CWE-119
synonym: buffer overrun
synonym: memory safety
synonym: Buffer Overflow
definition: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

DMA Device Enabled Too Early in Boot Phase
type: Class
subclass of: Incorrect Behavior Order
cwe-id: CWE-1190
definition: The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.

On-Chip Debug and Test Interface With Improper Access Control
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1191
definition: The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

Improper Identifier for IP Block used in System-On-Chip (SOC)
type: Class
subclass of: Violation of Secure Design Principles
cwe-id: CWE-1192
definition: The System-on-Chip (SoC) does not have unique, immutable identifiers for each of its components.
label: System-on-Chip (SoC) Using Components without Unique, Immutable Identifiers

Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
type: Class
subclass of: Incorrect Behavior Order
cwe-id: CWE-1193
definition: The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.

ASP.NET Misconfiguration: Missing Custom Error Page
type: Class
subclass of: Missing Custom Error Page
cwe-id: CWE-12
definition: An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
subclass of: Out-of-bounds Write
cwe-id: CWE-120
definition: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
synonym: Classic Buffer Overflow
synonym: Unbounded Transfer

Generation of Weak Initialization Vector (IV)
type: Class
subclass of: Use of Insufficiently Random Values
cwe-id: CWE-1204
definition: The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.

Failure to Disable Reserved Bits
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1209
definition: The reserved bits in a hardware design are not disabled prior to production. Typically, reserved bits are used for future capabilities and should not support any functional logic in the design. However, designers might covertly use these bits to debug or further develop new capabilities in production hardware. Adversaries with access to these bits will write to them in hopes of compromising hardware state.

Stack-based Buffer Overflow
type: Class
subclass of: Out-of-bounds Write
subclass of: Access of Memory Location After End of Buffer
cwe-id: CWE-121
definition: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
synonym: Stack Overflow

Heap-based Buffer Overflow
type: Class
subclass of: Out-of-bounds Write
subclass of: Access of Memory Location After End of Buffer
cwe-id: CWE-122
definition: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Insufficient Granularity of Access Control
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1220
definition: The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Incorrect Register Defaults or Module Parameters
type: Class
subclass of: Incorrect Initialization of Resource
subclass of: Improper Initialization
cwe-id: CWE-1221
definition: Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.

Insufficient Granularity of Address Regions Protected by Register Locks
type: Class
subclass of: Insufficient Granularity of Access Control
cwe-id: CWE-1222
definition: The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the functional requirement that some addresses need to be writable by software during operation and the security requirement that the system configuration lock bit must be set during the boot process.

Race Condition for Write-Once Attributes
type: Class
subclass of: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
cwe-id: CWE-1223
definition: A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.

Improper Restriction of Write-Once Bit Fields
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1224
definition: The hardware design control register "sticky bits" or write-once bit fields are improperly implemented, such that they can be reprogrammed by software.

Creation of Emergent Resource
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-1229
definition: The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.

Write-what-where Condition
type: Class
subclass of: Out-of-bounds Write
cwe-id: CWE-123
definition: Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

Exposure of Sensitive Information Through Metadata
type: Class
subclass of: Improper Authorization
cwe-id: CWE-1230
definition: The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.

Improper Prevention of Lock Bit Modification
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1231
definition: The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set.

Improper Lock Behavior After Power State Transition
type: Class
subclass of: Improper Locking
cwe-id: CWE-1232
definition: Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.

Security-Sensitive Hardware Controls with Missing Lock Bit Protection
type: Class
subclass of: Improper Access Control
subclass of: Improper Locking
cwe-id: CWE-1233
definition: The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.

Hardware Internal or Debug Modes Allow Override of Locks
type: Class
subclass of: Improper Locking
cwe-id: CWE-1234
definition: System configuration protection may be bypassed during debug mode.

Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
type: Class
subclass of: Uncontrolled Resource Consumption
cwe-id: CWE-1235
definition: The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.

Improper Neutralization of Formula Elements in a CSV File
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
cwe-id: CWE-1236
definition: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
synonym: CSV Injection
synonym: Excel Macro Injection
synonym: Formula Injection

Improper Zeroization of Hardware Register
type: Class
subclass of: Sensitive Information in Resource Not Removed Before Reuse
cwe-id: CWE-1239
definition: The hardware product does not properly clear sensitive information from built-in registers when the user of the hardware block changes.

Buffer Underwrite ('Buffer Underflow')
type: Class
subclass of: Access of Memory Location Before Start of Buffer
subclass of: Out-of-bounds Write
cwe-id: CWE-124
definition: The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
synonym: buffer underrun

Use of a Cryptographic Primitive with a Risky Implementation
type: Class
subclass of: Use of a Broken or Risky Cryptographic Algorithm
cwe-id: CWE-1240
definition: To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.

Use of Predictable Algorithm in Random Number Generator
type: Class
subclass of: Use of Insufficiently Random Values
cwe-id: CWE-1241
definition: The device uses an algorithm that is predictable and generates a pseudo-random number.

Inclusion of Undocumented Features or Chicken Bits
type: Class
subclass of: Improper Access Control
subclass of: Hidden Functionality
cwe-id: CWE-1242
definition: The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

Sensitive Non-Volatile Information Not Protected During Debug
type: Class
subclass of: Improper Physical Access Control
cwe-id: CWE-1243
definition: Access to security-sensitive information stored in fuses is not limited during debug.

Internal Asset Exposed to Unsafe Debug Access Level or State
type: Class
subclass of: Incorrect Authorization
cwe-id: CWE-1244
definition: The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.

Improper Finite State Machines (FSMs) in Hardware Logic
type: Class
subclass of: Incorrect Provision of Specified Functionality
cwe-id: CWE-1245
definition: Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.

Improper Write Handling in Limited-write Non-Volatile Memories
type: Class
subclass of: Uncontrolled Resource Consumption
cwe-id: CWE-1246
definition: The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.

Improper Protection Against Voltage and Clock Glitches
type: Class
subclass of: Improper Handling of Physical or Environmental Conditions
cwe-id: CWE-1247
definition: The device does not contain or contains incorrectly implemented circuitry or sensors to detect and mitigate voltage and clock glitches and protect sensitive information or software contained on the device.

Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1248
definition: The security-sensitive hardware module contains semiconductor defects.

Application-Level Admin Tool with Inconsistent View of Underlying Operating System
type: Class
subclass of: Improper Preservation of Consistency Between Independent Representations of Shared State
cwe-id: CWE-1249
definition: The product provides an application for administrators to manage parts of the underlying operating system, but the application does not accurately identify all of the relevant entities or resources that exist in the OS; that is, the application's model of the OS's state is inconsistent with the OS's actual state.
synonym: Ghost in the Shell

Out-of-bounds Read
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
subclass of: Restriction
  on property: weakness-of
  some values from: Raw Memory Access Function
type: NamedIndividual
weakness-of: Raw Memory Access Function
definition: The product reads data past the end, or before the beginning, of the intended buffer.
cwe-id: CWE-125
synonym: OOB read

Improper Preservation of Consistency Between Independent Representations of Shared State
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-1250
definition: The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.

Mirrored Regions with Different Values
type: Class
subclass of: Improper Preservation of Consistency Between Independent Representations of Shared State
cwe-id: CWE-1251
definition: The product's architecture mirrors regions without ensuring that their contents always stay in sync.

CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1252
definition: The CPU is not configured to provide hardware support for exclusivity of write and execute operations on memory. This allows an attacker to execute data from all of memory.

Incorrect Selection of Fuse Values
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1253
definition: The logic level used to set a system to a secure state relies on a fuse being unblown. An attacker can set the system to an insecure state merely by blowing the fuse.

Incorrect Comparison Logic Granularity
type: Class
subclass of: Observable Timing Discrepancy
subclass of: Incorrect Comparison
cwe-id: CWE-1254
definition: The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.

Comparison Logic is Vulnerable to Power Side-Channel Attacks
type: Class
subclass of: Improper Protection of Physical Side Channels
cwe-id: CWE-1255
definition: A device's real time power consumption may be monitored during security token evaluation and the information gleaned may be used to determine the value of the reference token.

Improper Restriction of Software Interfaces to Hardware Features
type: Class
subclass of: Improper Authorization
cwe-id: CWE-1256
definition: The product provides software-controllable device functionality for capabilities such as power and clock management, but it does not properly limit functionality that can lead to modification of hardware memory or register bits, or the ability to observe physical side channels.

Improper Access Control Applied to Mirrored or Aliased Memory Regions
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1257
definition: Aliased or mirrored memory regions in hardware designs may have inconsistent read/write permissions enforced by the hardware. A possible result is that an untrusted agent is blocked from accessing a memory region but is not blocked from accessing the corresponding aliased memory region.

Exposure of Sensitive System Information Due to Uncleared Debug Information
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
subclass of: Improper Removal of Sensitive Information Before Storage or Transfer
cwe-id: CWE-1258
definition: The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.

Improper Restriction of Security Token Assignment
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1259
definition: The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

Buffer Over-read
type: Class
subclass of: Out-of-bounds Read
subclass of: Access of Memory Location After End of Buffer
cwe-id: CWE-126
definition: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Improper Handling of Overlap Between Protected Memory Ranges
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1260
definition: The product allows address regions to overlap, which can result in the bypassing of intended memory protection.

Improper Handling of Single Event Upsets
type: Class
subclass of: Improper Handling of Physical or Environmental Conditions
cwe-id: CWE-1261
definition: The hardware logic does not effectively handle when single-event upsets (SEUs) occur.

Improper Access Control for Register Interface
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1262
definition: The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.

Improper Physical Access Control
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1263
definition: The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.

Hardware Logic with Insecure De-Synchronization between Control and Data Channels
type: Class
subclass of: Incorrect Synchronization
cwe-id: CWE-1264
definition: The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.

Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-1265
definition: During execution of non-reentrant code, the product performs a call that unintentionally produces a nested invocation of the non-reentrant code.

Improper Scrubbing of Sensitive Data from Decommissioned Device
type: Class
subclass of: Improper Resource Shutdown or Release
cwe-id: CWE-1266
definition: The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.

Policy Uses Obsolete Encoding
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1267
definition: The product uses an obsolete encoding mechanism to implement access controls.

Policy Privileges are not Assigned Consistently Between Control and Data Agents
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1268
definition: The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies.

Product Released in Non-Release Configuration
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1269
definition: The product released to market is released in pre-production or manufacturing configuration.

Buffer Under-read
type: Class
subclass of: Out-of-bounds Read
subclass of: Access of Memory Location Before Start of Buffer
cwe-id: CWE-127
definition: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

Generation of Incorrect Security Tokens
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1270
definition: The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.

Uninitialized Value on Reset for Registers Holding Security Settings
type: Class
subclass of: Missing Initialization of Resource
cwe-id: CWE-1271
definition: Security-critical logic is not set to a known value on reset.

Sensitive Information Uncleared Before Debug/Power State Transition
type: Class
subclass of: Sensitive Information in Resource Not Removed Before Reuse
cwe-id: CWE-1272
definition: The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.

Device Unlock Credential Sharing
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-1273
definition: The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information.

Improper Access Control for Volatile Memory Containing Boot Code
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1274
definition: The product conducts a secure-boot process that transfers bootloader code from Non-Volatile Memory (NVM) into Volatile Memory (VM), but it does not have sufficient access control or other protections for the Volatile Memory.

Sensitive Cookie with Improper SameSite Attribute
type: Class
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-1275
definition: The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

Hardware Child Block Incorrectly Connected to Parent System
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1276
definition: Signals between a hardware IP and the parent system design are incorrectly connected causing security risks.

Firmware Not Updateable
type: Class
subclass of: Reliance on Component That is Not Updateable
cwe-id: CWE-1277
definition: The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present.

Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1278
definition: Information stored in hardware may be recovered by an attacker with the capability to capture and analyze images of the integrated circuit using techniques such as scanning electron microscopy.

Cryptographic Operations are run Before Supporting Units are Ready
type: Class
subclass of: Improper Initialization
subclass of: Incorrect Behavior Order
cwe-id: CWE-1279
definition: Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

Wrap-around Error
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-128
definition: Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.

Access Control Check Implemented After Asset is Accessed
type: Class
subclass of: Improper Access Control
subclass of: Incorrect Behavior Order
cwe-id: CWE-1280
definition: A product's hardware-based access control check occurs after the asset has been accessed.

Sequence of Processor Instructions Leads to Unexpected Behavior
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-1281
definition: Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed.

Assumed-Immutable Data is Stored in Writable Memory
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-1282
definition: Immutable data, such as a first-stage bootloader, device identifiers, and "write-once" configuration settings are stored in writable memory that can be re-programmed or updated in the field.

Mutable Attestation or Measurement Reporting Data
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1283
definition: The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.

Improper Validation of Specified Quantity in Input
type: Class
subclass of: Improper Input Validation
cwe-id: CWE-1284
definition: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Improper Validation of Specified Index, Position, or Offset in Input
type: Class
subclass of: Improper Input Validation
cwe-id: CWE-1285
definition: The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.

Improper Validation of Syntactic Correctness of Input
type: Class
subclass of: Improper Input Validation
cwe-id: CWE-1286
definition: The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Improper Validation of Specified Type of Input
type: Class
subclass of: Improper Input Validation
cwe-id: CWE-1287
definition: The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Improper Validation of Consistency within Input
type: Class
subclass of: Improper Input Validation
cwe-id: CWE-1288
definition: The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.

Improper Validation of Unsafe Equivalence in Input
type: Class
subclass of: Improper Input Validation
cwe-id: CWE-1289
definition: The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Improper Validation of Array Index
type: Class
subclass of: Improper Validation of Specified Index, Position, or Offset in Input
cwe-id: CWE-129
definition: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
synonym: array index underflow
synonym: index-out-of-range
synonym: out-of-bounds array index

Incorrect Decoding of Security Identifiers
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1290
definition: The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset.

Public Key Re-Use for Signing both Debug and Production Code
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1291
definition: The same public key is used for signing both debug and production code.

Incorrect Conversion of Security Identifiers
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1292
definition: The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers. However, if the conversion is incorrectly implemented, untrusted agents can gain unauthorized access to the asset.

Missing Source Correlation of Multiple Independent Data
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-1293
definition: The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.

Insecure Security Identifier Mechanism
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1294
definition: The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.

Debug Messages Revealing Unnecessary Information
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-1295
definition: The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.

Incorrect Chaining or Granularity of Debug Components
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1296
definition: The product's debug components contain incorrect chaining or granularity of debug components.

Unprotected Confidential Information on Device is Accessible by OSAT Vendors
type: Class
subclass of: Improper Authorization
cwe-id: CWE-1297
definition: The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors.

Hardware Logic Contains Race Conditions
type: Class
subclass of: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
cwe-id: CWE-1298
definition: A race condition in the hardware logic results in undermining security guarantees of the system.

Missing Protection Mechanism for Alternate Hardware Interface
type: Class
subclass of: Authentication Bypass Using an Alternate Path or Channel
subclass of: Unprotected Alternate Channel
cwe-id: CWE-1299
definition: The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other external facing unguarded interfaces) allows an attacker to bypass existing protections to the asset that are only performed against the primary path.

ASP.NET Misconfiguration: Password in Configuration File
type: Class
subclass of: Password in Configuration File
cwe-id: CWE-13
definition: Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.

Improper Handling of Length Parameter Inconsistency
type: Class
subclass of: Improper Handling of Inconsistent Structural Elements
cwe-id: CWE-130
definition: The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
synonym: length manipulation
synonym: length tampering

Improper Protection of Physical Side Channels
type: Class
subclass of: Observable Discrepancy
cwe-id: CWE-1300
definition: The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.

Insufficient or Incomplete Data Removal within Hardware Component
type: Class
subclass of: Sensitive Information in Resource Not Removed Before Reuse
cwe-id: CWE-1301
definition: The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.

Missing Security Identifier
type: Class
subclass of: Insecure Security Identifier Mechanism
cwe-id: CWE-1302
definition: The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier.
label: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)

Non-Transparent Sharing of Microarchitectural Resources
type: Class
subclass of: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
subclass of: Observable Discrepancy
cwe-id: CWE-1303
definition: Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected architecture isolation between contexts.

Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1304
definition: The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained and/or verified between the beginning and ending of the operation.

Incorrect Calculation of Buffer Size
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-131
definition: The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Missing Ability to Patch ROM Code
type: Class
subclass of: Reliance on Component That is Not Updateable
cwe-id: CWE-1310
definition: Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.

Improper Translation of Security Attributes by Fabric Bridge
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1311
definition: The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.

Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1312
definition: The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions.

Hardware Allows Activation of Test or Debug Logic at Runtime
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1313
definition: During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the state of the hardware. This feature can alter the intended behavior of the system and allow for alteration and leakage of sensitive data by an adversary.

Missing Write Protection for Parametric Data Values
type: Class
subclass of: Missing Authorization
cwe-id: CWE-1314
definition: The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure.

Improper Setting of Bus Controlling Capability in Fabric End-point
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1315
definition: The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.

Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1316
definition: The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping portion of the protected region.

Improper Access Control in Fabric Bridge
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1317
definition: The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does not properly perform the expected privilege, identity, or other access control checks between those IP blocks.

Missing Support for Security Features in On-chip Fabrics or Buses
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1318
definition: On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.

Improper Protection against Electromagnetic Fault Injection (EM-FI)
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1319
definition: The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypassed.

Improper Protection for Outbound Error Messages and Alert Signals
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1320
definition: Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
type: Class
subclass of: Improperly Controlled Modification of Dynamically-Determined Object Attributes
cwe-id: CWE-1321
definition: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Use of Blocking Code in Single-threaded, Non-blocking Context
type: Class
subclass of: Excessive Iteration
cwe-id: CWE-1322
definition: The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.

Improper Management of Sensitive Trace Data
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1323
definition: Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted agents.

Improperly Controlled Sequential Memory Allocation
type: Class
subclass of: Allocation of Resources Without Limits or Throttling
cwe-id: CWE-1325
definition: The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
synonym: Stack Exhaustion

Missing Immutable Root of Trust in Hardware
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1326
definition: A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.

Binding to an Unrestricted IP Address
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-1327
definition: The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

Security Version Number Mutable to Older Versions
type: Class
subclass of: Improper Authorization
cwe-id: CWE-1328
definition: Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.

Reliance on Component That is Not Updateable
type: Class
subclass of: Reliance on Insufficiently Trustworthy Component
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-1329
definition: The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs.

Remanent Data Readable after Memory Erase
type: Class
subclass of: Insufficient or Incomplete Data Removal within Hardware Component
cwe-id: CWE-1330
definition: Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.

Improper Isolation of Shared Resources in Network On Chip (NoC)
type: Class
subclass of: Improper Isolation or Compartmentalization
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-1331
definition: The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such that they are shared between trusted and untrusted agents, creating timing channels.

Improper Handling of Faults that Lead to Instruction Skips
type: Class
subclass of: Improper Handling of Physical or Environmental Conditions
cwe-id: CWE-1332
definition: The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.

Inefficient Regular Expression Complexity
type: Class
subclass of: Inefficient Algorithmic Complexity
cwe-id: CWE-1333
definition: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
synonym: Catastrophic backtracking
synonym: ReDoS
synonym: Regular Expression Denial of Service

Unauthorized Error Injection Can Degrade Hardware Redundancy
type: Class
subclass of: Improper Access Control
cwe-id: CWE-1334
definition: An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.

Incorrect Bitwise Shift of Integer
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-1335
definition: An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.

Improper Neutralization of Special Elements Used in a Template Engine
type: Class
subclass of: Improper Control of Generation of Code ('Code Injection')
cwe-id: CWE-1336
definition: The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
synonym: Client-Side Template Injection / CSTI
synonym: Server-Side Template Injection / SSTI

Improper Protections Against Hardware Overheating
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-1338
definition: A hardware device is missing or has inadequate protection features to prevent overheating.

Insufficient Precision or Accuracy of a Real Number
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-1339
definition: The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result.

Use of Externally-Controlled Format String
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-134
definition: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Multiple Releases of Same Resource or Handle
type: Class
subclass of: Multiple Operations on Resource in Single-Operation Context
cwe-id: CWE-1341
definition: The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

Information Exposure through Microarchitectural State after Transient Execution
type: Class
subclass of: Sensitive Information in Resource Not Removed Before Reuse
cwe-id: CWE-1342
definition: The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.

Incorrect Calculation of Multi-Byte String Length
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-135
definition: The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.

Improper Handling of Hardware Behavior in Exceptionally Cold Environments
type: Class
subclass of: Improper Handling of Physical or Environmental Conditions
cwe-id: CWE-1351
definition: A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.

Reliance on Insufficiently Trustworthy Component
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-1357
definition: The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.

Improper Neutralization of Special Elements
type: Class
subclass of: Improper Neutralization
cwe-id: CWE-138
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Improper Handling of Physical or Environmental Conditions
type: Class
subclass of: Improper Check or Handling of Exceptional Conditions
cwe-id: CWE-1384
definition: The product does not properly handle unexpected physical or environmental conditions that occur naturally or are artificially induced.

Missing Origin Validation in WebSockets
type: Class
subclass of: Origin Validation Error
cwe-id: CWE-1385
definition: The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
synonym: Cross-Site WebSocket hijacking (CSWSH)

Insecure Operation on Windows Junction / Mount Point
type: Class
subclass of: Improper Link Resolution Before File Access ('Link Following')
cwe-id: CWE-1386
definition: The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.

Incorrect Parsing of Numbers with Different Radices
type: Class
subclass of: Incorrect Type Conversion or Cast
cwe-id: CWE-1389
definition: The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).

Weak Authentication
type: Class
subclass of: Improper Authentication
cwe-id: CWE-1390
definition: The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Use of Weak Credentials
type: Class
subclass of: Weak Authentication
cwe-id: CWE-1391
definition: The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

Use of Default Credentials
type: Class
subclass of: Use of Weak Credentials
cwe-id: CWE-1392
definition: The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Use of Default Password
type: Class
subclass of: Use of Default Credentials
subclass of: Restriction
  on property: weakness-of
  some values from: UserAccount
type: NamedIndividual
weakness-of: UserAccount
cwe-id: CWE-1393
definition: The product uses default passwords for potentially critical functionality.

Use of Default Cryptographic Key
type: Class
subclass of: Use of Default Credentials
cwe-id: CWE-1394
definition: The product uses a default cryptographic key for potentially critical functionality.

Dependency on Vulnerable Third-Party Component
type: Class
subclass of: Violation of Secure Design Principles
cwe-id: CWE-1395
definition: The product has a dependency on a third-party component that contains one or more known vulnerabilities.

Compiler Removal of Code to Clear Buffers
type: Class
subclass of: Compiler Optimization Removal or Modification of Security-critical Code
cwe-id: CWE-14
definition: Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."

Improper Neutralization of Delimiters
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-140
definition: The product does not neutralize or incorrectly neutralizes delimiters.

Improper Neutralization of Parameter/Argument Delimiters
type: Class
subclass of: Improper Neutralization of Delimiters
cwe-id: CWE-141
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

Incorrect Initialization of Resource
type: Class
subclass of: Improper Initialization
cwe-id: CWE-1419
definition: The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.

Improper Neutralization of Value Delimiters
type: Class
subclass of: Improper Neutralization of Delimiters
cwe-id: CWE-142
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Exposure of Sensitive Information during Transient Execution
type: Class
subclass of: Incorrect Resource Transfer Between Spheres
cwe-id: CWE-1420
definition: A processor event or prediction may allow incorrect operations (or correct operations with incorrect data) to execute transiently, potentially exposing data over a covert channel.

Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
type: Class
subclass of: Exposure of Sensitive Information during Transient Execution
cwe-id: CWE-1421
definition: A processor event may allow transient operations to access architecturally restricted data (for example, in another address space) in a shared microarchitectural structure (for example, a CPU cache), potentially exposing the data over a covert channel.

Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
type: Class
subclass of: Exposure of Sensitive Information during Transient Execution
cwe-id: CWE-1422
definition: A processor event or prediction may allow incorrect or stale data to be forwarded to transient operations, potentially exposing data over a covert channel.

Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
type: Class
subclass of: Exposure of Sensitive Information during Transient Execution
cwe-id: CWE-1423
definition: Shared microarchitectural predictor state may allow code to influence transient execution across a hardware boundary, potentially exposing data that is accessible beyond the boundary over a covert channel.

Improper Validation of Generative AI Output
type: Class
subclass of: Improper Neutralization
cwe-id: CWE-1426
definition: The product invokes a generative AI/ML component whose behaviors and outputs cannot be directly controlled, but the product does not validate or insufficiently validates the outputs to ensure that they align with the intended security, content, or privacy policy.

Improper Neutralization of Input Used for LLM Prompting
type: Class
subclass of: Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe-id: CWE-1427
definition: The product uses externally-provided data to build prompts provided to large language models (LLMs), but the way these prompts are constructed causes the LLM to fail to distinguish between user-supplied inputs and developer provided system directives.
synonym: prompt injection

Reliance on HTTP instead of HTTPS
type: Class
subclass of: Cleartext Transmission of Sensitive Information
cwe-id: CWE-1428
definition: The product provides or relies on use of HTTP communications when HTTPS is available.

Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface
type: Class
subclass of: Omission of Security-relevant Information
cwe-id: CWE-1429
definition: The product has a hardware interface that silently discards operations in situations for which feedback would be security-relevant, such as the timely detection of failures or attacks.

Improper Neutralization of Record Delimiters
type: Class
subclass of: Improper Neutralization of Delimiters
cwe-id: CWE-143
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

Driving Intermediate Cryptographic State/Results to Hardware Module Outputs
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-1431
definition: The product uses a hardware module implementing a cryptographic algorithm that writes sensitive information about the intermediate state or results of its cryptographic operations via one of its output wires (typically the output port containing the final result).

Improper Neutralization of Line Delimiters
type: Class
subclass of: Improper Neutralization of Delimiters
cwe-id: CWE-144
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.

Improper Neutralization of Section Delimiters
type: Class
subclass of: Improper Neutralization of Delimiters
cwe-id: CWE-145
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section delimiters when they are sent to a downstream component.

Improper Neutralization of Expression/Command Delimiters
type: Class
subclass of: Improper Neutralization of Delimiters
cwe-id: CWE-146
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

Improper Neutralization of Input Terminators
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-147
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.

Improper Neutralization of Input Leaders
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-148
definition: The product does not properly handle when a leading character or sequence ("leader") is missing or malformed, or if multiple leaders are used when only one should be allowed.

Improper Neutralization of Quoting Syntax
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-149
definition: Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

External Control of System or Configuration Setting
type: Class
subclass of: Externally Controlled Reference to a Resource in Another Sphere
subclass of: External Control of Critical State Data
cwe-id: CWE-15
definition: One or more system settings or configuration elements can be externally controlled by a user.

Improper Neutralization of Escape, Meta, or Control Sequences
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-150
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Improper Neutralization of Comment Delimiters
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-151
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.

Improper Neutralization of Macro Symbols
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-152
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as macro symbols when they are sent to a downstream component.

Improper Neutralization of Substitution Characters
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-153
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitution characters when they are sent to a downstream component.

Improper Neutralization of Variable Name Delimiters
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-154
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable name delimiters when they are sent to a downstream component.

Improper Neutralization of Wildcards or Matching Symbols
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-155
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.

Improper Neutralization of Whitespace
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-156
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component.
synonym: White space

Failure to Sanitize Paired Delimiters
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-157
definition: The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

Improper Neutralization of Null Byte or NUL Character
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-158
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

Improper Handling of Invalid Use of Special Elements
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-159
definition: The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.

Improper Neutralization of Leading Special Elements
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-160
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

Improper Neutralization of Multiple Leading Special Elements
type: Class
subclass of: Improper Neutralization of Leading Special Elements
cwe-id: CWE-161
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

Improper Neutralization of Trailing Special Elements
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-162
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

Improper Neutralization of Multiple Trailing Special Elements
type: Class
subclass of: Improper Neutralization of Trailing Special Elements
cwe-id: CWE-163
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

Improper Neutralization of Internal Special Elements
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-164
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

Improper Neutralization of Multiple Internal Special Elements
type: Class
subclass of: Improper Neutralization of Internal Special Elements
cwe-id: CWE-165
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

Improper Handling of Missing Special Element
type: Class
subclass of: Improper Handling of Invalid Use of Special Elements
subclass of: Improper Handling of Syntactically Invalid Structure
subclass of: Improper Check or Handling of Exceptional Conditions
cwe-id: CWE-166
definition: The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.

Improper Handling of Additional Special Element
type: Class
subclass of: Improper Handling of Invalid Use of Special Elements
subclass of: Improper Handling of Syntactically Invalid Structure
subclass of: Improper Check or Handling of Exceptional Conditions
cwe-id: CWE-167
definition: The product receives input from an upstream component, but it does not handle or incorrectly handles when an additional unexpected special element is provided.

Improper Handling of Inconsistent Special Elements
type: Class
subclass of: Improper Handling of Invalid Use of Special Elements
subclass of: Improper Handling of Syntactically Invalid Structure
subclass of: Improper Check or Handling of Exceptional Conditions
cwe-id: CWE-168
definition: The product does not properly handle input in which an inconsistency exists between two or more special characters or reserved words.

Improper Null Termination
type: Class
subclass of: Improper Neutralization
cwe-id: CWE-170
definition: The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Encoding Error
type: Class
subclass of: Improper Neutralization
cwe-id: CWE-172
definition: The product does not properly encode or decode the data, resulting in unexpected values.

Improper Handling of Alternate Encoding
type: Class
subclass of: Encoding Error
cwe-id: CWE-173
definition: The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.

Double Decoding of the Same Data
type: Class
subclass of: Encoding Error
subclass of: Multiple Operations on Resource in Single-Operation Context
cwe-id: CWE-174
definition: The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.

Improper Handling of Mixed Encoding
type: Class
subclass of: Encoding Error
cwe-id: CWE-175
definition: The product does not properly handle when the same input uses several different (mixed) encodings.

Improper Handling of Unicode Encoding
type: Class
subclass of: Encoding Error
cwe-id: CWE-176
definition: The product does not properly handle when an input contains Unicode encoding.

Improper Handling of URL Encoding (Hex Encoding)
type: Class
subclass of: Encoding Error
cwe-id: CWE-177
definition: The product does not properly handle when all or part of an input has been URL encoded.

Improper Handling of Case Sensitivity
type: Class
subclass of: Use of Incorrectly-Resolved Name or Reference
cwe-id: CWE-178
definition: The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Incorrect Behavior Order: Early Validation
type: Class
subclass of: Improper Input Validation
subclass of: Incorrect Behavior Order
cwe-id: CWE-179
definition: The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.

Incorrect Behavior Order: Validate Before Canonicalize
type: Class
subclass of: Incorrect Behavior Order: Early Validation
cwe-id: CWE-180
definition: The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Incorrect Behavior Order: Validate Before Filter
type: Class
subclass of: Incorrect Behavior Order: Early Validation
cwe-id: CWE-181
definition: The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.
synonym: Validate-before-cleanse

Collapse of Data into Unsafe Value
type: Class
subclass of: Protection Mechanism Failure
subclass of: Improper Neutralization
cwe-id: CWE-182
definition: The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.

Permissive List of Allowed Inputs
type: Class
subclass of: Incorrect Comparison
cwe-id: CWE-183
definition: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
synonym: Allowlist / Allow List
synonym: Safelist / Safe List
synonym: Whitelist / White List

Incomplete List of Disallowed Inputs
type: Class
subclass of: Incomplete Comparison with Missing Factors
subclass of: Protection Mechanism Failure
cwe-id: CWE-184
definition: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
synonym: Blacklist / Black List
synonym: Blocklist / Block List
synonym: Denylist / Deny List

Incorrect Regular Expression
type: Class
subclass of: Incorrect Comparison
cwe-id: CWE-185
definition: The product specifies a regular expression in a way that causes data to be improperly matched or compared.

Overly Restrictive Regular Expression
type: Class
subclass of: Incorrect Regular Expression
cwe-id: CWE-186
definition: A regular expression is overly restrictive, which prevents dangerous values from being detected.

Partial String Comparison
type: Class
subclass of: Incomplete Comparison with Missing Factors
cwe-id: CWE-187
definition: The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Reliance on Data/Memory Layout
type: Class
subclass of: Insufficient Encapsulation of Machine-Dependent Functionality
subclass of: Improper Interaction Between Multiple Correctly-Behaving Entities
cwe-id: CWE-188
definition: The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.

Integer Overflow or Wraparound
type: Class
subclass of: Incorrect Calculation
subclass of: Restriction
  on property: weakness-of
  some values from: Mathematical Function
type: NamedIndividual
weakness-of: Mathematical Function
definition: The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
synonym: wrap, wrap-around, wrap around
synonym: Overflow
synonym: Wraparound
cwe-id: CWE-190

Integer Underflow (Wrap or Wraparound)
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-191
definition: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
synonym: Integer underflow

Integer Coercion Error
type: Class
subclass of: Incorrect Conversion between Numeric Types
cwe-id: CWE-192
definition: Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

Off-by-one Error
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-193
definition: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
synonym: off-by-five

Unexpected Sign Extension
type: Class
subclass of: Incorrect Conversion between Numeric Types
cwe-id: CWE-194
definition: The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.

Signed to Unsigned Conversion Error
type: Class
subclass of: Incorrect Conversion between Numeric Types
cwe-id: CWE-195
definition: The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

Unsigned to Signed Conversion Error
type: Class
subclass of: Incorrect Conversion between Numeric Types
cwe-id: CWE-196
definition: The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.

Numeric Truncation Error
type: Class
subclass of: Incorrect Conversion between Numeric Types
cwe-id: CWE-197
definition: Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

Use of Incorrect Byte Ordering
type: Class
subclass of: Reliance on Data/Memory Layout
cwe-id: CWE-198
definition: The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.

Improper Input Validation
type: Class
subclass of: Improper Neutralization
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
cwe-id: CWE-20
definition: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Exposure of Sensitive Information to an Unauthorized Actor
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-200
definition: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
synonym: Information Disclosure
synonym: Information Leak

Insertion of Sensitive Information Into Sent Data
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-201
definition: The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Exposure of Sensitive Information Through Data Queries
type: Class
subclass of: Exposure of Sensitive Information Through Metadata
cwe-id: CWE-202
definition: When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Observable Discrepancy
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-203
definition: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
synonym: Side Channel Attack

Observable Response Discrepancy
type: Class
subclass of: Observable Discrepancy
cwe-id: CWE-204
definition: The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Observable Behavioral Discrepancy
type: Class
subclass of: Observable Discrepancy
cwe-id: CWE-205
definition: The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.

Observable Internal Behavioral Discrepancy
type: Class
subclass of: Observable Behavioral Discrepancy
cwe-id: CWE-206
definition: The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.

Observable Behavioral Discrepancy With Equivalent Products
type: Class
subclass of: Observable Behavioral Discrepancy
cwe-id: CWE-207
definition: The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker.

Observable Timing Discrepancy
type: Class
subclass of: Observable Discrepancy
cwe-id: CWE-208
definition: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Generation of Error Message Containing Sensitive Information
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-209
definition: The product generates an error message that includes sensitive information about its environment, users, or associated data.

Self-generated Error Message Containing Sensitive Information
type: Class
subclass of: Generation of Error Message Containing Sensitive Information
cwe-id: CWE-210
definition: The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Externally-Generated Error Message Containing Sensitive Information
type: Class
subclass of: Generation of Error Message Containing Sensitive Information
cwe-id: CWE-211
definition: The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

Improper Removal of Sensitive Information Before Storage or Transfer
type: Class
subclass of: Incorrect Resource Transfer Between Spheres
cwe-id: CWE-212
definition: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Exposure of Sensitive Information Due to Incompatible Policies
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-213
definition: The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

Invocation of Process Using Visible Sensitive Information
type: Class
subclass of: Exposure of Sensitive System Information to an Unauthorized Control Sphere
cwe-id: CWE-214
definition: A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Insertion of Sensitive Information Into Debugging Code
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-215
definition: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Storage of File with Sensitive Data Under Web Root
type: Class
subclass of: Files or Directories Accessible to External Parties
cwe-id: CWE-219
definition: The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: Class
subclass of: Exposure of Resource to Wrong Sphere
subclass of: Use of Incorrectly-Resolved Name or Reference
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
cwe-id: CWE-22
definition: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
synonym: Path traversal
synonym: Directory traversal

Storage of File With Sensitive Data Under FTP Root
type: Class
subclass of: Files or Directories Accessible to External Parties
cwe-id: CWE-220
definition: The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.

Information Loss or Omission
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-221
definition: The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Truncation of Security-relevant Information
type: Class
subclass of: Information Loss or Omission
cwe-id: CWE-222
definition: The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.

Omission of Security-relevant Information
type: Class
subclass of: Information Loss or Omission
cwe-id: CWE-223
definition: The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Obscured Security-relevant Information by Alternate Name
type: Class
subclass of: Information Loss or Omission
cwe-id: CWE-224
definition: The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

Sensitive Information in Resource Not Removed Before Reuse
type: Class
subclass of: Improper Removal of Sensitive Information Before Storage or Transfer
subclass of: Incomplete Cleanup
cwe-id: CWE-226
definition: The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

Improper Handling of Syntactically Invalid Structure
type: Class
subclass of: Improper Check or Handling of Exceptional Conditions
subclass of: Improper Neutralization
cwe-id: CWE-228
definition: The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

Improper Handling of Values
type: Class
subclass of: Improper Handling of Syntactically Invalid Structure
cwe-id: CWE-229
definition: The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.

Relative Path Traversal
type: Class
subclass of: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe-id: CWE-23
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
synonym: Zip Slip

Improper Handling of Missing Values
type: Class
subclass of: Improper Handling of Values
cwe-id: CWE-230
definition: The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.

Improper Handling of Extra Values
type: Class
subclass of: Improper Handling of Values
cwe-id: CWE-231
definition: The product does not handle or incorrectly handles when more values are provided than expected.

Improper Handling of Undefined Values
type: Class
subclass of: Improper Handling of Values
cwe-id: CWE-232
definition: The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.

Improper Handling of Parameters
type: Class
subclass of: Improper Handling of Syntactically Invalid Structure
cwe-id: CWE-233
definition: The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

Failure to Handle Missing Parameter
type: Class
subclass of: Improper Handling of Parameters
cwe-id: CWE-234
definition: If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

Improper Handling of Extra Parameters
type: Class
subclass of: Improper Handling of Parameters
cwe-id: CWE-235
definition: The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.

Improper Handling of Undefined Parameters
type: Class
subclass of: Improper Handling of Parameters
cwe-id: CWE-236
definition: The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.

Improper Handling of Structural Elements
type: Class
subclass of: Improper Handling of Syntactically Invalid Structure
cwe-id: CWE-237
definition: The product does not handle or incorrectly handles inputs that are related to complex structures.

Improper Handling of Incomplete Structural Elements
type: Class
subclass of: Improper Handling of Structural Elements
cwe-id: CWE-238
definition: The product does not handle or incorrectly handles when a particular structural element is not completely specified.

Failure to Handle Incomplete Element
type: Class
subclass of: Improper Handling of Structural Elements
cwe-id: CWE-239
definition: The product does not properly handle when a particular element is not completely specified.

Path Traversal: '../filedir'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-24
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Improper Handling of Inconsistent Structural Elements
type: Class
subclass of: Improper Handling of Structural Elements
subclass of: Improper Neutralization
cwe-id: CWE-240
definition: The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.

Improper Handling of Unexpected Data Type
type: Class
subclass of: Improper Handling of Syntactically Invalid Structure
cwe-id: CWE-241
definition: The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).

Use of Inherently Dangerous Function
type: Class
subclass of: Use of Prohibited Code
cwe-id: CWE-242
definition: The product calls a function that can never be guaranteed to work safely.

Creation of chroot Jail Without Changing Working Directory
type: Class
subclass of: Improper Following of Specification by Caller
subclass of: Incorrect Resource Transfer Between Spheres
cwe-id: CWE-243
definition: The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.

Improper Clearing of Heap Memory Before Release ('Heap Inspection')
type: Class
subclass of: Sensitive Information in Resource Not Removed Before Reuse
cwe-id: CWE-244
definition: Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.

J2EE Bad Practices: Direct Management of Connections
type: Class
subclass of: Use of Low-Level Functionality
cwe-id: CWE-245
definition: The J2EE application directly manages connections, instead of using the container's connection management facilities.

J2EE Bad Practices: Direct Use of Sockets
type: Class
subclass of: Use of Low-Level Functionality
cwe-id: CWE-246
definition: The J2EE application directly uses sockets instead of using framework method calls.

Uncaught Exception
type: Class
subclass of: Improper Check or Handling of Exceptional Conditions
subclass of: Incorrect Control Flow Scoping
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-248
definition: An exception is thrown from a function, but it is not caught.

Path Traversal: '/../filedir'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-25
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.

Execution with Unnecessary Privileges
type: Class
subclass of: Improper Privilege Management
subclass of: Violation of Secure Design Principles
cwe-id: CWE-250
definition: The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Unchecked Return Value
type: Class
subclass of: Improper Check for Unusual or Exceptional Conditions
cwe-id: CWE-252
definition: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Incorrect Check of Function Return Value
type: Class
subclass of: Improper Following of Specification by Caller
subclass of: Improper Check for Unusual or Exceptional Conditions
cwe-id: CWE-253
definition: The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

Plaintext Storage of a Password
type: Class
subclass of: Insufficiently Protected Credentials
cwe-id: CWE-256
definition: Storing a password in plaintext may result in a system compromise.

Storing Passwords in a Recoverable Format
type: Class
subclass of: Insufficiently Protected Credentials
cwe-id: CWE-257
definition: The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

Empty Password in Configuration File
type: Class
subclass of: Password in Configuration File
subclass of: Weak Password Requirements
cwe-id: CWE-258
definition: Using an empty string as a password is insecure.

Use of Hard-coded Password
type: Class
subclass of: Use of Hard-coded Credentials
cwe-id: CWE-259
definition: The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Path Traversal: '/dir/../filename'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-26
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.

Password in Configuration File
type: Class
subclass of: Insufficiently Protected Credentials
cwe-id: CWE-260
definition: The product stores a password in a configuration file that might be accessible to actors who do not know the password.

Weak Encoding for Password
type: Class
subclass of: Insufficiently Protected Credentials
cwe-id: CWE-261
definition: Obscuring a password with a trivial encoding does not protect the password.

Not Using Password Aging
type: Class
subclass of: Weak Authentication
cwe-id: CWE-262
definition: The product does not have a mechanism in place for managing password aging.

Password Aging with Long Expiration
type: Class
subclass of: Weak Authentication
cwe-id: CWE-263
definition: The product supports password aging, but the expiration period is too long.

Incorrect Privilege Assignment
type: Class
subclass of: Improper Privilege Management
cwe-id: CWE-266
definition: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Privilege Defined With Unsafe Actions
type: Class
subclass of: Improper Privilege Management
cwe-id: CWE-267
definition: A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

Privilege Chaining
type: Class
subclass of: Improper Privilege Management
cwe-id: CWE-268
definition: Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.

Improper Privilege Management
type: Class
subclass of: Improper Access Control
cwe-id: CWE-269
definition: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Path Traversal: 'dir/../../filename'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-27
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.

Privilege Context Switching Error
type: Class
subclass of: Improper Privilege Management
cwe-id: CWE-270
definition: The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.

Privilege Dropping / Lowering Errors
type: Class
subclass of: Improper Privilege Management
cwe-id: CWE-271
definition: The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

Least Privilege Violation
type: Class
subclass of: Privilege Dropping / Lowering Errors
cwe-id: CWE-272
definition: The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

Improper Check for Dropped Privileges
type: Class
subclass of: Privilege Dropping / Lowering Errors
subclass of: Improper Check for Unusual or Exceptional Conditions
cwe-id: CWE-273
definition: The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

Improper Handling of Insufficient Privileges
type: Class
subclass of: Improper Privilege Management
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-274
definition: The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.

Incorrect Default Permissions
type: Class
subclass of: Incorrect Permission Assignment for Critical Resource
subclass of: Restriction
  on property: weakness-of
  some values from: Application Installer
type: NamedIndividual
weakness-of: Application Installer
definition: During installation, installed file permissions are set to allow anyone to modify those files.
cwe-id: CWE-276

Insecure Inherited Permissions
type: Class
subclass of: Incorrect Permission Assignment for Critical Resource
cwe-id: CWE-277
definition: A product defines a set of insecure permissions that are inherited by objects that are created by the program.

Insecure Preserved Inherited Permissions
type: Class
subclass of: Incorrect Permission Assignment for Critical Resource
cwe-id: CWE-278
definition: A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.

Incorrect Execution-Assigned Permissions
type: Class
subclass of: Incorrect Permission Assignment for Critical Resource
cwe-id: CWE-279
definition: While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

Path Traversal: '..\filedir'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-28
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "..\" sequences that can resolve to a location that is outside of that directory.

Improper Handling of Insufficient Permissions or Privileges
type: Class
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-280
definition: The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Improper Preservation of Permissions
type: Class
subclass of: Incorrect Permission Assignment for Critical Resource
cwe-id: CWE-281
definition: The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Improper Ownership Management
type: Class
subclass of: Improper Access Control
cwe-id: CWE-282
definition: The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

Unverified Ownership
type: Class
subclass of: Improper Ownership Management
cwe-id: CWE-283
definition: The product does not properly verify that a critical resource is owned by the proper entity.

Improper Access Control
type: Class
subclass of: Weakness
cwe-id: CWE-284
definition: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
synonym: Authorization

Improper Authorization
type: Class
subclass of: Improper Access Control
cwe-id: CWE-285
definition: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
synonym: AuthZ

Incorrect User Management
type: Class
subclass of: Improper Access Control
cwe-id: CWE-286
definition: The product does not properly manage a user within its environment.

Improper Authentication
type: Class
subclass of: Improper Access Control
subclass of: Restriction
  on property: weakness-of
  some values from: Authentication Function
type: NamedIndividual
weakness-of: Authentication Function
definition: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
synonym: AuthN
synonym: AuthC
synonym: authentification
cwe-id: CWE-287

Authentication Bypass Using an Alternate Path or Channel
type: Class
subclass of: Missing Authentication for Critical Function
cwe-id: CWE-288
definition: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Authentication Bypass by Alternate Name
type: Class
subclass of: Weak Authentication
cwe-id: CWE-289
definition: The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Path Traversal: '\..\filename'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-29
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Authentication Bypass by Spoofing
type: Class
subclass of: Weak Authentication
cwe-id: CWE-290
definition: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Reliance on IP Address for Authentication
type: Class
subclass of: Authentication Bypass by Spoofing
subclass of: Modification of Assumed-Immutable Data (MAID)
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-291
definition: The product uses an IP address for authentication.

Using Referer Field for Authentication
type: Class
subclass of: Authentication Bypass by Spoofing
cwe-id: CWE-293
definition: The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
synonym: referrer

Authentication Bypass by Capture-replay
type: Class
subclass of: Weak Authentication
cwe-id: CWE-294
definition: A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Improper Certificate Validation
type: Class
subclass of: Improper Authentication
cwe-id: CWE-295
definition: The product does not validate, or incorrectly validates, a certificate.

Improper Following of a Certificate's Chain of Trust
type: Class
subclass of: Improper Certificate Validation
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-296
definition: The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

Improper Validation of Certificate with Host Mismatch
type: Class
subclass of: Improper Certificate Validation
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-297
definition: The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Improper Validation of Certificate Expiration
type: Class
subclass of: Improper Certificate Validation
subclass of: Operation on a Resource after Expiration or Release
cwe-id: CWE-298
definition: A certificate expiration is not validated or is incorrectly validated, so trust may be assigned to certificates that have been abandoned due to age.

Improper Check for Certificate Revocation
type: Class
subclass of: Improper Certificate Validation
subclass of: Improper Resource Shutdown or Release
cwe-id: CWE-299
definition: The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

Path Traversal: '\dir\..\filename'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-30
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\dir\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Channel Accessible by Non-Endpoint
type: Class
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-300
definition: The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
synonym: Adversary-in-the-Middle / AITM
synonym: Interception attack
synonym: Man-in-the-Middle / MITM
synonym: Manipulator-in-the-Middle
synonym: Monkey-in-the-Middle
synonym: Monster-in-the-Middle
synonym: On-path attack
synonym: Person-in-the-Middle / PITM

Reflection Attack in an Authentication Protocol
type: Class
subclass of: Weak Authentication
cwe-id: CWE-301
definition: Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user.

Authentication Bypass by Assumed-Immutable Data
type: Class
subclass of: Weak Authentication
subclass of: Reliance on Untrusted Inputs in a Security Decision
cwe-id: CWE-302
definition: The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

Incorrect Implementation of Authentication Algorithm
type: Class
subclass of: Weak Authentication
cwe-id: CWE-303
definition: The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Missing Critical Step in Authentication
type: Class
subclass of: Incorrect Implementation of Authentication Algorithm
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-304
definition: The product implements an authentication technique, but it skips a step that weakens the technique.

Authentication Bypass by Primary Weakness
type: Class
subclass of: Weak Authentication
cwe-id: CWE-305
definition: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Missing Authentication for Critical Function
type: Class
subclass of: Improper Authentication
cwe-id: CWE-306
definition: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Improper Restriction of Excessive Authentication Attempts
type: Class
subclass of: Weak Authentication
subclass of: Improper Control of Interaction Frequency
cwe-id: CWE-307
definition: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Use of Single-factor Authentication
type: Class
subclass of: Weak Authentication
subclass of: Reliance on a Single Factor in a Security Decision
cwe-id: CWE-308
definition: The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.

Use of Password System for Primary Authentication
type: Class
subclass of: Weak Authentication
subclass of: Reliance on a Single Factor in a Security Decision
cwe-id: CWE-309
definition: The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.

Path Traversal: 'dir\..\..\filename'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-31
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\..\..\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Missing Encryption of Sensitive Data
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-311
definition: The product does not encrypt sensitive or critical information before storage or transmission.

Cleartext Storage of Sensitive Information
type: Class
subclass of: Missing Encryption of Sensitive Data
subclass of: Insecure Storage of Sensitive Information
cwe-id: CWE-312
definition: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Cleartext Storage in a File or on Disk
type: Class
subclass of: Cleartext Storage of Sensitive Information
cwe-id: CWE-313
definition: The product stores sensitive information in cleartext in a file, or on disk.

Cleartext Storage in the Registry
type: Class
subclass of: Cleartext Storage of Sensitive Information
cwe-id: CWE-314
definition: The product stores sensitive information in cleartext in the registry.

Cleartext Storage of Sensitive Information in a Cookie
type: Class
subclass of: Cleartext Storage of Sensitive Information
cwe-id: CWE-315
definition: The product stores sensitive information in cleartext in a cookie.

Cleartext Storage of Sensitive Information in Memory
type: Class
subclass of: Cleartext Storage of Sensitive Information
cwe-id: CWE-316
definition: The product stores sensitive information in cleartext in memory.

Cleartext Storage of Sensitive Information in GUI
type: Class
subclass of: Cleartext Storage of Sensitive Information
cwe-id: CWE-317
definition: The product stores sensitive information in cleartext within the GUI.

Cleartext Storage of Sensitive Information in Executable
type: Class
subclass of: Cleartext Storage of Sensitive Information
cwe-id: CWE-318
definition: The product stores sensitive information in cleartext in an executable.

Cleartext Transmission of Sensitive Information
type: Class
subclass of: Missing Encryption of Sensitive Data
cwe-id: CWE-319
definition: The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Path Traversal: '...' (Triple Dot)
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-32
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '...' (triple dot) sequences that can resolve to a location that is outside of that directory.

Use of Hard-coded Cryptographic Key
type: Class
subclass of: Use of Hard-coded Credentials
cwe-id: CWE-321
definition: The product uses a hard-coded, unchangeable cryptographic key.

Key Exchange without Entity Authentication
type: Class
subclass of: Missing Authentication for Critical Function
cwe-id: CWE-322
definition: The product performs a key exchange with an actor without verifying the identity of that actor.

Reusing a Nonce, Key Pair in Encryption
type: Class
subclass of: Use of Invariant Value in Dynamically Changing Context
cwe-id: CWE-323
definition: Nonces should be used for the present occasion and only once.

Use of a Key Past its Expiration Date
type: Class
subclass of: Operation on a Resource after Expiration or Release
cwe-id: CWE-324
definition: The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

Missing Cryptographic Step
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-325
definition: The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

Inadequate Encryption Strength
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-326
definition: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Use of a Broken or Risky Cryptographic Algorithm
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-327
definition: The product uses a broken or risky cryptographic algorithm or protocol.

Use of Weak Hash
type: Class
subclass of: Inadequate Encryption Strength
subclass of: Use of a Broken or Risky Cryptographic Algorithm
cwe-id: CWE-328
definition: The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Generation of Predictable IV with CBC Mode
type: Class
subclass of: Generation of Weak Initialization Vector (IV)
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-329
definition: The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

Path Traversal: '....' (Multiple Dot)
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-33
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....' (multiple dot) sequences that can resolve to a location that is outside of that directory.

Use of Insufficiently Random Values
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-330
definition: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Insufficient Entropy
type: Class
subclass of: Use of Insufficiently Random Values
cwe-id: CWE-331
definition: The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Insufficient Entropy in PRNG
type: Class
subclass of: Insufficient Entropy
cwe-id: CWE-332
definition: The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.

Improper Handling of Insufficient Entropy in TRNG
type: Class
subclass of: Insufficient Entropy
subclass of: Improper Check or Handling of Exceptional Conditions
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-333
definition: True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.

Small Space of Random Values
type: Class
subclass of: Use of Insufficiently Random Values
cwe-id: CWE-334
definition: The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
type: Class
subclass of: Use of Insufficiently Random Values
cwe-id: CWE-335
definition: The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

Same Seed in Pseudo-Random Number Generator (PRNG)
type: Class
subclass of: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
cwe-id: CWE-336
definition: A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

Predictable Seed in Pseudo-Random Number Generator (PRNG)
type: Class
subclass of: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
cwe-id: CWE-337
definition: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
type: Class
subclass of: Use of Insufficiently Random Values
cwe-id: CWE-338
definition: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Small Seed Space in PRNG
type: Class
subclass of: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
cwe-id: CWE-339
definition: A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.

Path Traversal: '....//'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-34
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....//' (doubled dot dot slash) sequences that can resolve to a location that is outside of that directory.

Generation of Predictable Numbers or Identifiers
type: Class
subclass of: Use of Insufficiently Random Values
cwe-id: CWE-340
definition: The product uses a scheme that generates numbers or identifiers that are more predictable than required.

Predictable from Observable State
type: Class
subclass of: Generation of Predictable Numbers or Identifiers
cwe-id: CWE-341
definition: A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

Predictable Exact Value from Previous Values
type: Class
subclass of: Generation of Predictable Numbers or Identifiers
cwe-id: CWE-342
definition: An exact value or random number can be precisely predicted by observing previous values.

Predictable Value Range from Previous Values
type: Class
subclass of: Generation of Predictable Numbers or Identifiers
cwe-id: CWE-343
definition: The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.

Use of Invariant Value in Dynamically Changing Context
type: Class
subclass of: Use of Insufficiently Random Values
cwe-id: CWE-344
definition: The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Insufficient Verification of Data Authenticity
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-345
definition: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Origin Validation Error
type: Class
subclass of: Improper Access Control
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-346
definition: The product does not properly verify that the source of data or communication is valid.

Improper Verification of Cryptographic Signature
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-347
definition: The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Use of Less Trusted Source
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-348
definition: The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Acceptance of Extraneous Untrusted Data With Trusted Data
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-349
definition: The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Path Traversal: '.../...//'
type: Class
subclass of: Relative Path Traversal
cwe-id: CWE-35
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Reliance on Reverse DNS Resolution for a Security-Critical Action
type: Class
subclass of: Authentication Bypass by Spoofing
subclass of: Reliance on Untrusted Inputs in a Security Decision
cwe-id: CWE-350
definition: The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

Insufficient Type Distinction
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-351
definition: The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

Cross-Site Request Forgery (CSRF)
type: Class
subclass of: Insufficient Verification of Data Authenticity
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
definition: The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
synonym: XSRF
synonym: Session Riding
synonym: Cross Site Reference Forgery
cwe-id: CWE-352
synonym: CSRF

Missing Support for Integrity Check
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-353
definition: The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Improper Validation of Integrity Check Value
type: Class
subclass of: Insufficient Verification of Data Authenticity
subclass of: Improper Check for Unusual or Exceptional Conditions
cwe-id: CWE-354
definition: The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Product UI does not Warn User of Unsafe Actions
type: Class
subclass of: Information Loss or Omission
cwe-id: CWE-356
definition: The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.

Insufficient UI Warning of Dangerous Operations
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-357
definition: The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.

Improperly Implemented Security Check for Standard
type: Class
subclass of: Improper Following of Specification by Caller
subclass of: Protection Mechanism Failure
cwe-id: CWE-358
definition: The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

Exposure of Private Personal Information to an Unauthorized Actor
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-359
definition: The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
synonym: Privacy leak
synonym: Privacy leakage
synonym: Privacy violation

Absolute Path Traversal
type: Class
subclass of: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe-id: CWE-36
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Trust of System Event Data
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-360
definition: Security based on event locations are insecure and can be spoofed.

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
type: Class
subclass of: Insufficient Control Flow Management
subclass of: Restriction
  on property: weakness-of
  some values from: Shared Resource Access Function
type: NamedIndividual
weakness-of: Shared Resource Access Function
definition: The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
synonym: Race Condition
cwe-id: CWE-362

Race Condition Enabling Link Following
type: Class
subclass of: Time-of-check Time-of-use (TOCTOU) Race Condition
cwe-id: CWE-363
definition: The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

Signal Handler Race Condition
type: Class
subclass of: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
cwe-id: CWE-364
definition: The product uses a signal handler that introduces a race condition.

Race Condition within a Thread
type: Class
subclass of: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
cwe-id: CWE-366
definition: If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

Time-of-check Time-of-use (TOCTOU) Race Condition
type: Class
subclass of: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
cwe-id: CWE-367
definition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
synonym: TOCCTOU
synonym: TOCTTOU

Context Switching Race Condition
type: Class
subclass of: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
cwe-id: CWE-368
definition: A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch.

Divide By Zero
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-369
definition: The product divides a value by zero.

Path Traversal: '/absolute/pathname/here'
type: Class
subclass of: Improper Neutralization of Leading Special Elements
subclass of: Absolute Path Traversal
cwe-id: CWE-37
definition: The product accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Missing Check for Certificate Revocation after Initial Check
type: Class
subclass of: Improper Check for Certificate Revocation
cwe-id: CWE-370
definition: The product does not check the revocation status of a certificate after its initial revocation check, which can cause the product to perform privileged actions even after the certificate is revoked at a later time.

Incomplete Internal State Distinction
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-372
definition: The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

Passing Mutable Objects to an Untrusted Method
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-374
definition: The product sends non-cloned mutable data as an argument to a method or function.

Returning a Mutable Object to an Untrusted Caller
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-375
definition: Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.

Insecure Temporary File
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-377
definition: Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Creation of Temporary File With Insecure Permissions
type: Class
subclass of: Insecure Temporary File
cwe-id: CWE-378
definition: Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

Creation of Temporary File in Directory with Insecure Permissions
type: Class
subclass of: Insecure Temporary File
cwe-id: CWE-379
definition: The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Path Traversal: '\absolute\pathname\here'
type: Class
subclass of: Absolute Path Traversal
cwe-id: CWE-38
definition: The product accepts input in the form of a backslash absolute path ('\absolute\pathname\here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.

J2EE Bad Practices: Use of System.exit()
type: Class
subclass of: Incorrect Control Flow Scoping
cwe-id: CWE-382
definition: A J2EE application uses System.exit(), which also shuts down its container.

J2EE Bad Practices: Direct Use of Threads
type: Class
subclass of: Use of Low-Level Functionality
cwe-id: CWE-383
definition: Thread management in a Web application is forbidden in some circumstances and is always highly error prone.

Session Fixation
type: Class
subclass of: Externally Controlled Reference to a Resource in Another Sphere
cwe-id: CWE-384
definition: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Covert Timing Channel
type: Class
subclass of: Covert Channel
cwe-id: CWE-385
definition: Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

Symbolic Name not Mapping to Correct Object
type: Class
subclass of: Use of Incorrectly-Resolved Name or Reference
cwe-id: CWE-386
definition: A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.

Path Traversal: 'C:dirname'
type: Class
subclass of: Absolute Path Traversal
cwe-id: CWE-39
definition: The product accepts input that contains a drive letter or Windows volume letter ('C:dirname') that potentially redirects access to an unintended location or arbitrary file.

Detection of Error Condition Without Action
type: Class
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-390
definition: The product detects a specific error, but takes no actions to handle the error.

Unchecked Error Condition
type: Class
subclass of: Improper Check for Unusual or Exceptional Conditions
cwe-id: CWE-391
definition: [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.

Missing Report of Error Condition
type: Class
subclass of: Incorrect Provision of Specified Functionality
subclass of: Improper Check or Handling of Exceptional Conditions
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-392
definition: The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.

Return of Wrong Status Code
type: Class
subclass of: Incorrect Provision of Specified Functionality
subclass of: Improper Check or Handling of Exceptional Conditions
cwe-id: CWE-393
definition: A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.

Unexpected Status Code or Return Value
type: Class
subclass of: Improper Check for Unusual or Exceptional Conditions
cwe-id: CWE-394
definition: The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

Use of NullPointerException Catch to Detect NULL Pointer Dereference
type: Class
subclass of: Incorrect Control Flow Scoping
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-395
definition: Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

Declaration of Catch for Generic Exception
type: Class
subclass of: Information Loss or Omission
subclass of: Incorrect Control Flow Scoping
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-396
definition: Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

Declaration of Throws for Generic Exception
type: Class
subclass of: Information Loss or Omission
subclass of: Improper Check or Handling of Exceptional Conditions
subclass of: Incorrect Control Flow Scoping
cwe-id: CWE-397
definition: The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions.

Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
type: Class
subclass of: Absolute Path Traversal
cwe-id: CWE-40
definition: The product accepts input that identifies a Windows UNC share ('\\UNC\share\name') that potentially redirects access to an unintended location or arbitrary file.

Uncontrolled Resource Consumption
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-400
definition: The product does not properly control the allocation and maintenance of a limited resource.
synonym: Resource Exhaustion

Missing Release of Memory after Effective Lifetime
type: Class
subclass of: Missing Release of Resource after Effective Lifetime
cwe-id: CWE-401
definition: The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
synonym: Memory Leak

Transmission of Private Resources into a New Sphere ('Resource Leak')
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-402
definition: The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
synonym: Resource Leak

Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
type: Class
subclass of: Transmission of Private Resources into a New Sphere ('Resource Leak')
cwe-id: CWE-403
definition: A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.
synonym: File descriptor leak

Improper Resource Shutdown or Release
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-404
definition: The product does not release or incorrectly releases a resource before it is made available for re-use.

Asymmetric Resource Consumption (Amplification)
type: Class
subclass of: Uncontrolled Resource Consumption
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-405
definition: The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Insufficient Control of Network Message Volume (Network Amplification)
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-406
definition: The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

Inefficient Algorithmic Complexity
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-407
definition: An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
synonym: Quadratic Complexity

Incorrect Behavior Order: Early Amplification
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
subclass of: Incorrect Behavior Order
cwe-id: CWE-408
definition: The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.

Improper Handling of Highly Compressed Data (Data Amplification)
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
cwe-id: CWE-409
definition: The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Improper Resolution of Path Equivalence
type: Class
subclass of: Use of Incorrectly-Resolved Name or Reference
cwe-id: CWE-41
definition: The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

Insufficient Resource Pool
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-410
definition: The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Unrestricted Externally Accessible Lock
type: Class
subclass of: Improper Locking
cwe-id: CWE-412
definition: The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.

Improper Resource Locking
type: Class
subclass of: Improper Locking
cwe-id: CWE-413
definition: The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.

Missing Lock Check
type: Class
subclass of: Improper Locking
cwe-id: CWE-414
definition: A product does not check to see if a lock is present before performing sensitive operations on a resource.

Double Free
type: Class
subclass of: Multiple Releases of Same Resource or Handle
subclass of: Operation on Resource in Wrong Phase of Lifetime
subclass of: Expired Pointer Dereference
subclass of: Restriction
  on property: weakness-of
  some values from: Memory Free Function
type: NamedIndividual
weakness-of: Memory Free Function
definition: The product calls free() twice on the same memory address.
synonym: Double-free
cwe-id: CWE-415

Use After Free
type: Class
subclass of: Expired Pointer Dereference
cwe-id: CWE-416
definition: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
synonym: Dangling pointer
synonym: UAF
synonym: Use-After-Free

Unprotected Primary Channel
type: Class
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-419
definition: The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

Path Equivalence: 'filename.' (Trailing Dot)
type: Class
subclass of: Improper Neutralization of Trailing Special Elements
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-42
definition: The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Unprotected Alternate Channel
type: Class
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-420
definition: The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

Race Condition During Access to Alternate Channel
type: Class
subclass of: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
subclass of: Unprotected Alternate Channel
cwe-id: CWE-421
definition: The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.

Unprotected Windows Messaging Channel ('Shatter')
type: Class
subclass of: Trust of System Event Data
subclass of: Unprotected Alternate Channel
cwe-id: CWE-422
definition: The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.

Improper Protection of Alternate Path
type: Class
subclass of: Not Using Complete Mediation
subclass of: Protection Mechanism Failure
cwe-id: CWE-424
definition: The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Direct Request ('Forced Browsing')
type: Class
subclass of: Authentication Bypass Using an Alternate Path or Channel
subclass of: Improper Protection of Alternate Path
subclass of: Missing Authorization
cwe-id: CWE-425
definition: The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
synonym: forced browsing

Untrusted Search Path
type: Class
subclass of: External Control of Critical State Data
subclass of: External Influence of Sphere Definition
cwe-id: CWE-426
definition: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
synonym: Untrusted Path

Uncontrolled Search Path Element
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-427
definition: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
synonym: Binary planting
synonym: DLL preloading
synonym: Dependency confusion
synonym: Insecure library loading

Unquoted Search Path or Element
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-428
definition: The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Path Equivalence: 'filename....' (Multiple Trailing Dot)
type: Class
subclass of: Improper Neutralization of Multiple Trailing Special Elements
subclass of: Path Equivalence: 'filename.' (Trailing Dot)
cwe-id: CWE-43
definition: The product accepts path input in the form of multiple trailing dot ('filedir....') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Deployment of Wrong Handler
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-430
definition: The wrong "handler" is assigned to process an object.

Missing Handler
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-431
definition: A handler is not available or implemented.

Dangerous Signal Handler not Disabled During Sensitive Operations
type: Class
subclass of: Signal Handler Race Condition
cwe-id: CWE-432
definition: The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.

Unparsed Raw Web Content Delivery
type: Class
subclass of: Storage of File with Sensitive Data Under Web Root
cwe-id: CWE-433
definition: The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.

Unrestricted Upload of File with Dangerous Type
type: Class
subclass of: Incorrect Resource Transfer Between Spheres
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
synonym: Unrestricted File Upload
definition: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
cwe-id: CWE-434

Improper Interaction Between Multiple Correctly-Behaving Entities
type: Class
subclass of: Weakness
cwe-id: CWE-435
definition: An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
synonym: Emergent Fault
synonym: Interaction Error

Interpretation Conflict
type: Class
subclass of: Improper Interaction Between Multiple Correctly-Behaving Entities
cwe-id: CWE-436
definition: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Incomplete Model of Endpoint Features
type: Class
subclass of: Interpretation Conflict
cwe-id: CWE-437
definition: A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.

Behavioral Change in New Version or Environment
type: Class
subclass of: Improper Interaction Between Multiple Correctly-Behaving Entities
cwe-id: CWE-439
definition: A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.
synonym: Functional change

Path Equivalence: 'file.name' (Internal Dot)
type: Class
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-44
definition: The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Expected Behavior Violation
type: Class
subclass of: Incorrect Provision of Specified Functionality
cwe-id: CWE-440
definition: A feature, API, or function does not perform according to its specification.

Unintended Proxy or Intermediary ('Confused Deputy')
type: Class
subclass of: Externally Controlled Reference to a Resource in Another Sphere
cwe-id: CWE-441
definition: The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
synonym: Confused Deputy

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
type: Class
subclass of: Interpretation Conflict
cwe-id: CWE-444
definition: The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
synonym: HTTP Request Smuggling
synonym: HTTP Response Smuggling
synonym: HTTP Smuggling

UI Discrepancy for Security Feature
type: Class
subclass of: Incorrect Provision of Specified Functionality
cwe-id: CWE-446
definition: The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.

Unimplemented or Unsupported Feature in UI
type: Class
subclass of: UI Discrepancy for Security Feature
subclass of: Lack of Administrator Control over Security
cwe-id: CWE-447
definition: A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented.

Obsolete Feature in UI
type: Class
subclass of: UI Discrepancy for Security Feature
cwe-id: CWE-448
definition: A UI function is obsolete and the product does not warn the user.

The UI Performs the Wrong Action
type: Class
subclass of: UI Discrepancy for Security Feature
cwe-id: CWE-449
definition: The UI performs the wrong action with respect to the user's request.

Path Equivalence: 'file...name' (Multiple Internal Dot)
type: Class
subclass of: Improper Neutralization of Multiple Internal Special Elements
subclass of: Path Equivalence: 'file.name' (Internal Dot)
cwe-id: CWE-45
definition: The product accepts path input in the form of multiple internal dot ('file...dir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Multiple Interpretations of UI Input
type: Class
subclass of: Insufficient UI Warning of Dangerous Operations
cwe-id: CWE-450
definition: The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.

User Interface (UI) Misrepresentation of Critical Information
type: Class
subclass of: Information Loss or Omission
subclass of: Incorrect Provision of Specified Functionality
cwe-id: CWE-451
definition: The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Insecure Default Variable Initialization
type: Class
subclass of: Initialization of a Resource with an Insecure Default
cwe-id: CWE-453
definition: The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

External Initialization of Trusted Variables or Data Stores
type: Class
subclass of: Incorrect Initialization of Resource
subclass of: Improper Initialization
cwe-id: CWE-454
definition: The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.

Non-exit on Failed Initialization
type: Class
subclass of: Not Failing Securely ('Failing Open')
subclass of: Improper Initialization
subclass of: Incorrect Control Flow Scoping
cwe-id: CWE-455
definition: The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.

Missing Initialization of a Variable
type: Class
subclass of: Missing Initialization of Resource
cwe-id: CWE-456
definition: The product does not initialize critical variables, which causes the execution environment to use unexpected values.

Use of Uninitialized Variable
type: Class
subclass of: Use of Uninitialized Resource
cwe-id: CWE-457
definition: The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Incomplete Cleanup
type: Class
subclass of: Improper Resource Shutdown or Release
cwe-id: CWE-459
definition: The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
synonym: Insufficient Cleanup

Path Equivalence: 'filename ' (Trailing Space)
type: Class
subclass of: Improper Neutralization of Trailing Special Elements
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-46
definition: The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Improper Cleanup on Thrown Exception
type: Class
subclass of: Incomplete Cleanup
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-460
definition: The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

Duplicate Key in Associative List (Alist)
type: Class
subclass of: Use of Multiple Resources with Duplicate Identifier
cwe-id: CWE-462
definition: Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error.

Deletion of Data Structure Sentinel
type: Class
subclass of: Improper Neutralization
cwe-id: CWE-463
definition: The accidental deletion of a data-structure sentinel can cause serious programming logic problems.

Addition of Data Structure Sentinel
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-464
definition: The accidental addition of a data-structure sentinel can cause serious programming logic problems.

Return of Pointer Value Outside of Expected Range
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
cwe-id: CWE-466
definition: A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.

Use of sizeof() on a Pointer Type
type: Class
subclass of: Incorrect Calculation of Buffer Size
cwe-id: CWE-467
definition: The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.

Incorrect Pointer Scaling
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-468
definition: In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.

Use of Pointer Subtraction to Determine Size
type: Class
subclass of: Incorrect Calculation
cwe-id: CWE-469
definition: The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.

Path Equivalence: ' filename' (Leading Space)
type: Class
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-47
definition: The product accepts path input in the form of leading space (' filedir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
type: Class
subclass of: Externally Controlled Reference to a Resource in Another Sphere
subclass of: Improper Control of Dynamically-Managed Code Resources
cwe-id: CWE-470
definition: The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
synonym: Reflection Injection

Modification of Assumed-Immutable Data (MAID)
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-471
definition: The product does not properly protect an assumed-immutable element from being modified by an attacker.

External Control of Assumed-Immutable Web Parameter
type: Class
subclass of: Modification of Assumed-Immutable Data (MAID)
subclass of: External Control of Critical State Data
cwe-id: CWE-472
definition: The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
synonym: Assumed-Immutable Parameter Tampering

PHP External Variable Modification
type: Class
subclass of: Modification of Assumed-Immutable Data (MAID)
cwe-id: CWE-473
definition: A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.

Use of Function with Inconsistent Implementations
type: Class
subclass of: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe-id: CWE-474
definition: The code uses a function that has inconsistent implementations across operating systems and versions.

Undefined Behavior for Input to API
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-475
definition: The behavior of this function is undefined unless its control parameter is set to a specific value.

NULL Pointer Dereference
type: Class
subclass of: Improper Adherence to Coding Standards
subclass of: Improper Check for Unusual or Exceptional Conditions
subclass of: Restriction
  on property: weakness-of
  some values from: Pointer Dereferencing Function
type: NamedIndividual
weakness-of: Pointer Dereferencing Function
synonym: NPD
cwe-id: CWE-476
synonym: null deref
definition: The product dereferences a pointer that it expects to be valid but is NULL.
synonym: nil pointer dereference
synonym: NPE

Use of Obsolete Function
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-477
definition: The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

Missing Default Case in Multiple Condition Expression
type: Class
subclass of: Incomplete Comparison with Missing Factors
cwe-id: CWE-478
definition: The code does not have a default case in an expression with multiple conditions, such as a switch statement.

Signal Handler Use of a Non-reentrant Function
type: Class
subclass of: Use of a Non-reentrant Function in a Concurrent Context
subclass of: Signal Handler with Functionality that is not Asynchronous-Safe
cwe-id: CWE-479
definition: The product defines a signal handler that calls a non-reentrant function.

Path Equivalence: 'file name' (Internal Whitespace)
type: Class
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-48
definition: The product accepts path input in the form of internal space ('file(SPACE)name') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Use of Incorrect Operator
type: Class
subclass of: Always-Incorrect Control Flow Implementation
cwe-id: CWE-480
definition: The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

Assigning instead of Comparing
type: Class
subclass of: Use of Incorrect Operator
cwe-id: CWE-481
definition: The code uses an operator for assignment when the intention was to perform a comparison.

Comparing instead of Assigning
type: Class
subclass of: Use of Incorrect Operator
cwe-id: CWE-482
definition: The code uses an operator for comparison when the intention was to perform an assignment.

Incorrect Block Delimitation
type: Class
subclass of: Always-Incorrect Control Flow Implementation
cwe-id: CWE-483
definition: The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

Omitted Break Statement in Switch
type: Class
subclass of: Always-Incorrect Control Flow Implementation
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-484
definition: The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

Comparison of Classes by Name
type: Class
subclass of: Comparison Using Wrong Factors
cwe-id: CWE-486
definition: The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.

Reliance on Package-level Scope
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-487
definition: Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.

Exposure of Data Element to Wrong Session
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-488
definition: The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Active Debug Code
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-489
definition: The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
synonym: Leftover debug code

Path Equivalence: 'filename/' (Trailing Slash)
type: Class
subclass of: Improper Neutralization of Trailing Special Elements
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-49
definition: The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Public cloneable() Method Without Final ('Object Hijack')
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-491
definition: A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.

Use of Inner Class Containing Sensitive Data
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-492
definition: Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.

Critical Public Variable Without Final Modifier
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-493
definition: The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

Download of Code Without Integrity Check
type: Class
subclass of: Insufficient Verification of Data Authenticity
subclass of: Incorrect Resource Transfer Between Spheres
cwe-id: CWE-494
definition: The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Private Data Structure Returned From A Public Method
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-495
definition: The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.

Public Data Assigned to Private Array-Typed Field
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-496
definition: Assigning public data to a private array is equivalent to giving public access to the array.

Exposure of Sensitive System Information to an Unauthorized Control Sphere
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-497
definition: The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Cloneable Class Containing Sensitive Information
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-498
definition: The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.

Serializable Class Containing Sensitive Data
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-499
definition: The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.

J2EE Misconfiguration: Data Transmission Without Encryption
type: Class
subclass of: Cleartext Transmission of Sensitive Information
cwe-id: CWE-5
definition: Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

Path Equivalence: '//multiple/leading/slash'
type: Class
subclass of: Improper Neutralization of Multiple Leading Special Elements
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-50
definition: The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Public Static Field Not Marked Final
type: Class
subclass of: Critical Public Variable Without Final Modifier
cwe-id: CWE-500
definition: An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

Trust Boundary Violation
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-501
definition: The product mixes trusted and untrusted data in the same data structure or structured message.

Deserialization of Untrusted Data
type: Class
subclass of: Improper Control of Dynamically-Managed Code Resources
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: UserInputFunction
subclass of: Restriction
  on property: weakness-of
  some values from: Deserialization Function
type: NamedIndividual
may-be-weakness-of: UserInputFunction
weakness-of: Deserialization Function
synonym: Marshaling, Unmarshaling
definition: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
cwe-id: CWE-502
synonym: PHP Object Injection
synonym: Pickling, Unpickling

Embedded Malicious Code
type: Class
subclass of: Hidden Functionality
cwe-id: CWE-506
definition: The product contains code that appears to be malicious in nature.

Trojan Horse
type: Class
subclass of: Embedded Malicious Code
cwe-id: CWE-507
definition: The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator.

Non-Replicating Malicious Code
type: Class
subclass of: Trojan Horse
cwe-id: CWE-508
definition: Non-replicating malicious code only resides on the target system or product that is attacked; it does not attempt to spread to other systems.

Replicating Malicious Code (Virus or Worm)
type: Class
subclass of: Trojan Horse
cwe-id: CWE-509
definition: Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product.

Path Equivalence: '/multiple//internal/slash'
type: Class
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-51
definition: The product accepts path input in the form of multiple internal slash ('/multiple//internal/slash/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Trapdoor
type: Class
subclass of: Embedded Malicious Code
cwe-id: CWE-510
definition: A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism.

Logic/Time Bomb
type: Class
subclass of: Embedded Malicious Code
cwe-id: CWE-511
definition: The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.

Spyware
type: Class
subclass of: Embedded Malicious Code
cwe-id: CWE-512
definition: The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.

Covert Channel
type: Class
subclass of: Creation of Emergent Resource
cwe-id: CWE-514
definition: A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.

Covert Storage Channel
type: Class
subclass of: Covert Channel
cwe-id: CWE-515
definition: A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information.

Path Equivalence: '/multiple/trailing/slash//'
type: Class
subclass of: Improper Neutralization of Multiple Trailing Special Elements
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-52
definition: The product accepts path input in the form of multiple trailing slash ('/multiple/trailing/slash//') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

.NET Misconfiguration: Use of Impersonation
type: Class
subclass of: Incorrect Privilege Assignment
cwe-id: CWE-520
definition: Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.

Weak Password Requirements
type: Class
subclass of: Use of Weak Credentials
cwe-id: CWE-521
definition: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Insufficiently Protected Credentials
type: Class
subclass of: Weak Authentication
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-522
definition: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Unprotected Transport of Credentials
type: Class
subclass of: Insufficiently Protected Credentials
cwe-id: CWE-523
definition: Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Use of Cache Containing Sensitive Information
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-524
definition: The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Use of Web Browser Cache Containing Sensitive Information
type: Class
subclass of: Use of Cache Containing Sensitive Information
cwe-id: CWE-525
definition: The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

Cleartext Storage of Sensitive Information in an Environment Variable
type: Class
subclass of: Cleartext Storage of Sensitive Information
cwe-id: CWE-526
definition: The product uses an environment variable to store unencrypted sensitive information.

Exposure of Version-Control Repository to an Unauthorized Control Sphere
type: Class
subclass of: Files or Directories Accessible to External Parties
cwe-id: CWE-527
definition: The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

Exposure of Core Dump File to an Unauthorized Control Sphere
type: Class
subclass of: Files or Directories Accessible to External Parties
cwe-id: CWE-528
definition: The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

Exposure of Access Control List Files to an Unauthorized Control Sphere
type: Class
subclass of: Files or Directories Accessible to External Parties
cwe-id: CWE-529
definition: The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.

Path Equivalence: '\multiple\\internal\backslash'
type: Class
subclass of: Improper Neutralization of Multiple Internal Special Elements
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-53
definition: The product accepts path input in the form of multiple internal backslash ('\multiple\trailing\\slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Exposure of Backup File to an Unauthorized Control Sphere
type: Class
subclass of: Files or Directories Accessible to External Parties
cwe-id: CWE-530
definition: A backup file is stored in a directory or archive that is made accessible to unauthorized actors.

Inclusion of Sensitive Information in Test Code
type: Class
subclass of: Inclusion of Sensitive Information in Source Code
cwe-id: CWE-531
definition: Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.

Insertion of Sensitive Information into Log File
type: Class
subclass of: Insertion of Sensitive Information into Externally-Accessible File or Directory
cwe-id: CWE-532
definition: The product writes sensitive information to a log file.

Exposure of Information Through Shell Error Message
type: Class
subclass of: Externally-Generated Error Message Containing Sensitive Information
cwe-id: CWE-535
definition: A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.

Servlet Runtime Error Message Containing Sensitive Information
type: Class
subclass of: Externally-Generated Error Message Containing Sensitive Information
cwe-id: CWE-536
definition: A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

Java Runtime Error Message Containing Sensitive Information
type: Class
subclass of: Externally-Generated Error Message Containing Sensitive Information
cwe-id: CWE-537
definition: In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.

Insertion of Sensitive Information into Externally-Accessible File or Directory
type: Class
subclass of: Exposure of Sensitive Information to an Unauthorized Actor
cwe-id: CWE-538
definition: The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Use of Persistent Cookies Containing Sensitive Information
type: Class
subclass of: Files or Directories Accessible to External Parties
cwe-id: CWE-539
definition: The web application uses persistent cookies, but the cookies contain sensitive information.

Path Equivalence: 'filedir\' (Trailing Backslash)
type: Class
subclass of: Improper Neutralization of Trailing Special Elements
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-54
definition: The product accepts path input in the form of trailing backslash ('filedir\') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Inclusion of Sensitive Information in Source Code
type: Class
subclass of: Insertion of Sensitive Information into Externally-Accessible File or Directory
cwe-id: CWE-540
definition: Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

Inclusion of Sensitive Information in an Include File
type: Class
subclass of: Inclusion of Sensitive Information in Source Code
cwe-id: CWE-541
definition: If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.

Use of Singleton Pattern Without Synchronization in a Multithreaded Context
type: Class
subclass of: Missing Synchronization
cwe-id: CWE-543
definition: The product uses the singleton pattern when creating a resource within a multithreaded environment.

Missing Standardized Error Handling Mechanism
type: Class
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-544
definition: The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.

Suspicious Comment
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-546
definition: The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.

Use of Hard-coded, Security-relevant Constants
type: Class
subclass of: Inappropriate Source Code Style or Formatting
cwe-id: CWE-547
definition: The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.

Exposure of Information Through Directory Listing
type: Class
subclass of: Exposure of Sensitive System Information to an Unauthorized Control Sphere
cwe-id: CWE-548
definition: The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.

Missing Password Field Masking
type: Class
subclass of: Insufficiently Protected Credentials
cwe-id: CWE-549
definition: The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

Path Equivalence: '/./' (Single Dot Directory)
type: Class
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-55
definition: The product accepts path input in the form of single dot directory exploit ('/./') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Server-generated Error Message Containing Sensitive Information
type: Class
subclass of: Generation of Error Message Containing Sensitive Information
cwe-id: CWE-550
definition: Certain conditions, such as network failure, will cause a server error message to be displayed.

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
type: Class
subclass of: Incorrect Behavior Order
subclass of: Incorrect Authorization
cwe-id: CWE-551
definition: If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

Files or Directories Accessible to External Parties
type: Class
subclass of: Improper Authorization
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-552
definition: The product makes files or directories accessible to unauthorized actors, even though they should not be.

Command Shell in Externally Accessible Directory
type: Class
subclass of: Files or Directories Accessible to External Parties
cwe-id: CWE-553
definition: A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.

ASP.NET Misconfiguration: Not Using Input Validation Framework
type: Class
subclass of: Improper Use of Validation Framework
cwe-id: CWE-554
definition: The ASP.NET application does not use an input validation framework.

J2EE Misconfiguration: Plaintext Password in Configuration File
type: Class
subclass of: Password in Configuration File
cwe-id: CWE-555
definition: The J2EE application stores a plaintext password in a configuration file.

ASP.NET Misconfiguration: Use of Identity Impersonation
type: Class
subclass of: Incorrect Privilege Assignment
cwe-id: CWE-556
definition: Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.

Use of getlogin() in Multithreaded Application
type: Class
subclass of: Use of a Non-reentrant Function in a Concurrent Context
cwe-id: CWE-558
definition: The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.

Path Equivalence: 'filedir*' (Wildcard)
type: Class
subclass of: Improper Neutralization of Wildcards or Matching Symbols
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-56
definition: The product accepts path input in the form of asterisk wildcard ('filedir*') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Use of umask() with chmod-style Argument
type: Class
subclass of: Function Call With Incorrectly Specified Argument Value
cwe-id: CWE-560
definition: The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod().

Dead Code
type: Class
subclass of: Irrelevant Code
cwe-id: CWE-561
definition: The product contains dead code, which can never be executed.

Return of Stack Variable Address
type: Class
subclass of: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe-id: CWE-562
definition: A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.

Assignment to Variable without Use
type: Class
subclass of: Irrelevant Code
cwe-id: CWE-563
definition: The variable's value is assigned but never used, making it a dead store.
synonym: Unused Variable

SQL Injection: Hibernate
type: Class
subclass of: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
cwe-id: CWE-564
definition: Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.

Reliance on Cookies without Validation and Integrity Checking
type: Class
subclass of: Client-Side Enforcement of Server-Side Security
subclass of: External Control of Critical State Data
cwe-id: CWE-565
definition: The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Authorization Bypass Through User-Controlled SQL Primary Key
type: Class
subclass of: Authorization Bypass Through User-Controlled Key
cwe-id: CWE-566
definition: The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

Unsynchronized Access to Shared Data in a Multithreaded Context
type: Class
subclass of: Missing Synchronization
cwe-id: CWE-567
definition: The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

finalize() Method Without super.finalize()
type: Class
subclass of: Incomplete Cleanup
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-568
definition: The product contains a finalize() method that does not call super.finalize().

Path Equivalence: 'fakedir/../realdir/filename'
type: Class
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-57
definition: The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.

Expression is Always False
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-570
definition: The product contains an expression that will always evaluate to false.

Expression is Always True
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-571
definition: The product contains an expression that will always evaluate to true.

Call to Thread run() instead of start()
type: Class
subclass of: Incorrect Synchronization
cwe-id: CWE-572
definition: The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.

Improper Following of Specification by Caller
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-573
definition: The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

EJB Bad Practices: Use of Synchronization Primitives
type: Class
subclass of: Use of Low-Level Functionality
subclass of: Incorrect Synchronization
cwe-id: CWE-574
definition: The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives.

EJB Bad Practices: Use of AWT Swing
type: Class
subclass of: Use of Low-Level Functionality
cwe-id: CWE-575
definition: The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.

EJB Bad Practices: Use of Java I/O
type: Class
subclass of: Use of Low-Level Functionality
cwe-id: CWE-576
definition: The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.

EJB Bad Practices: Use of Sockets
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-577
definition: The product violates the Enterprise JavaBeans (EJB) specification by using sockets.

EJB Bad Practices: Use of Class Loader
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-578
definition: The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.

J2EE Bad Practices: Non-serializable Object Stored in Session
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-579
definition: The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.

Path Equivalence: Windows 8.3 Filename
type: Class
subclass of: Improper Resolution of Path Equivalence
cwe-id: CWE-58
definition: The product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short "8.3" filename.

clone() Method Without super.clone()
type: Class
subclass of: Improper Following of Specification by Caller
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-580
definition: The product contains a clone() method that does not call super.clone() to obtain the new object.

Object Model Violation: Just One of Equals and Hashcode Defined
type: Class
subclass of: Improper Following of Specification by Caller
subclass of: Incorrect Comparison
cwe-id: CWE-581
definition: The product does not maintain equal hashcodes for equal objects.

Array Declared Public, Final, and Static
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-582
definition: The product declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified.

finalize() Method Declared Public
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-583
definition: The product violates secure coding principles for mobile code by declaring a finalize() method public.

Return Inside Finally Block
type: Class
subclass of: Incorrect Control Flow Scoping
cwe-id: CWE-584
definition: The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.

Empty Synchronized Block
type: Class
subclass of: Empty Code Block
cwe-id: CWE-585
definition: The product contains an empty synchronized block.

Explicit Call to Finalize()
type: Class
subclass of: Insufficient Adherence to Expected Conventions
cwe-id: CWE-586
definition: The product makes an explicit call to the finalize() method from outside the finalizer.

Assignment of a Fixed Address to a Pointer
type: Class
subclass of: Use of Invariant Value in Dynamically Changing Context
subclass of: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe-id: CWE-587
definition: The product sets a pointer to a specific address other than NULL or 0.

Attempt to Access Child of a Non-structure Pointer
type: Class
subclass of: Incorrect Type Conversion or Cast
subclass of: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe-id: CWE-588
definition: Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.

Call to Non-ubiquitous API
type: Class
subclass of: Use of Function with Inconsistent Implementations
cwe-id: CWE-589
definition: The product uses an API function that does not exist on all versions of the target platform. This could cause portability problems or inconsistencies that allow denial of service or other consequences.

Improper Link Resolution Before File Access ('Link Following')
type: Class
subclass of: Use of Incorrectly-Resolved Name or Reference
cwe-id: CWE-59
definition: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
synonym: Zip Slip
synonym: insecure temporary file

Free of Memory not on the Heap
type: Class
subclass of: Mismatched Memory Management Routines
subclass of: Restriction
  on property: weakness-of
  some values from: Memory Free Function
type: NamedIndividual
weakness-of: Memory Free Function
cwe-id: CWE-590
definition: The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

Sensitive Data Storage in Improperly Locked Memory
type: Class
subclass of: Improper Resource Locking
cwe-id: CWE-591
definition: The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.

Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
type: Class
subclass of: Weak Authentication
subclass of: Operation on Resource in Wrong Phase of Lifetime
cwe-id: CWE-593
definition: The product modifies the SSL context after connection creation has begun.

J2EE Framework: Saving Unserializable Objects to Disk
type: Class
subclass of: Insufficient Adherence to Expected Conventions
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-594
definition: When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.

Comparison of Object References Instead of Object Contents
type: Class
subclass of: Comparison Using Wrong Factors
cwe-id: CWE-595
definition: The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.

Use of Wrong Operator in String Comparison
type: Class
subclass of: Use of Incorrect Operator
subclass of: Comparison of Object References Instead of Object Contents
cwe-id: CWE-597
definition: The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

Use of GET Request Method With Sensitive Query Strings
type: Class
subclass of: Insertion of Sensitive Information Into Sent Data
cwe-id: CWE-598
definition: The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Missing Validation of OpenSSL Certificate
type: Class
subclass of: Improper Certificate Validation
cwe-id: CWE-599
definition: The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

J2EE Misconfiguration: Insufficient Session-ID Length
type: Class
subclass of: Small Space of Random Values
cwe-id: CWE-6
definition: The J2EE application is configured to use an insufficient session ID length.

Uncaught Exception in Servlet
type: Class
subclass of: Uncaught Exception
cwe-id: CWE-600
definition: The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
synonym: Missing Catch Block

URL Redirection to Untrusted Site ('Open Redirect')
type: Class
subclass of: Externally Controlled Reference to a Resource in Another Sphere
cwe-id: CWE-601
definition: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
synonym: Cross-domain Redirect
synonym: Cross-site Redirect
synonym: Open Redirect
synonym: Unvalidated Redirect

Client-Side Enforcement of Server-Side Security
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-602
definition: The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Use of Client-Side Authentication
type: Class
subclass of: Weak Authentication
subclass of: Client-Side Enforcement of Server-Side Security
cwe-id: CWE-603
definition: A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

Multiple Binds to the Same Port
type: Class
subclass of: Operation on Resource in Wrong Phase of Lifetime
subclass of: Multiple Operations on Resource in Single-Operation Context
cwe-id: CWE-605
definition: When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.

Unchecked Input for Loop Condition
type: Class
subclass of: Improper Validation of Specified Quantity in Input
cwe-id: CWE-606
definition: The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Public Static Final Field References Mutable Object
type: Class
subclass of: Modification of Assumed-Immutable Data (MAID)
cwe-id: CWE-607
definition: A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.

Struts: Non-private Field in ActionForm Class
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-608
definition: An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.

Double-Checked Locking
type: Class
subclass of: Improper Locking
cwe-id: CWE-609
definition: The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.

UNIX Symbolic Link (Symlink) Following
type: Class
subclass of: Improper Link Resolution Before File Access ('Link Following')
cwe-id: CWE-61
definition: The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
synonym: Symlink following
synonym: symlink vulnerability

Externally Controlled Reference to a Resource in Another Sphere
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-610
definition: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Improper Restriction of XML External Entity Reference
type: Class
subclass of: Externally Controlled Reference to a Resource in Another Sphere
subclass of: Restriction
  on property: weakness-of
  some values from: External Content Inclusion Function
type: NamedIndividual
weakness-of: External Content Inclusion Function
synonym: XXE
cwe-id: CWE-611
definition: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Improper Authorization of Index Containing Sensitive Information
type: Class
subclass of: Exposure of Sensitive Information Through Metadata
cwe-id: CWE-612
definition: The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.

Insufficient Session Expiration
type: Class
subclass of: Operation on a Resource after Expiration or Release
cwe-id: CWE-613
definition: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
type: Class
subclass of: Cleartext Transmission of Sensitive Information
cwe-id: CWE-614
definition: The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Inclusion of Sensitive Information in Source Code Comments
type: Class
subclass of: Inclusion of Sensitive Information in Source Code
cwe-id: CWE-615
definition: While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.

Incomplete Identification of Uploaded File Variables (PHP)
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-616
definition: The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

Reachable Assertion
type: Class
subclass of: Always-Incorrect Control Flow Implementation
cwe-id: CWE-617
definition: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
synonym: assertion failure

Exposed Unsafe ActiveX Method
type: Class
subclass of: Exposed Dangerous Method or Function
cwe-id: CWE-618
definition: An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).

Dangling Database Cursor ('Cursor Injection')
type: Class
subclass of: Transmission of Private Resources into a New Sphere ('Resource Leak')
cwe-id: CWE-619
definition: If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling."

UNIX Hard Link
type: Class
subclass of: Improper Link Resolution Before File Access ('Link Following')
cwe-id: CWE-62
definition: The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Unverified Password Change
type: Class
subclass of: Weak Authentication
cwe-id: CWE-620
definition: When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Variable Extraction Error
type: Class
subclass of: Improper Control of Dynamically-Identified Variables
cwe-id: CWE-621
definition: The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.
synonym: Variable overwrite

Improper Validation of Function Hook Arguments
type: Class
subclass of: Improper Input Validation
cwe-id: CWE-622
definition: The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities.

Unsafe ActiveX Control Marked Safe For Scripting
type: Class
subclass of: Privilege Defined With Unsafe Actions
cwe-id: CWE-623
definition: An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

Executable Regular Expression Error
type: Class
subclass of: Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe-id: CWE-624
definition: The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Permissive Regular Expression
type: Class
subclass of: Incorrect Regular Expression
cwe-id: CWE-625
definition: The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Null Byte Interaction Error (Poison Null Byte)
type: Class
subclass of: Improper Neutralization of Input Terminators
subclass of: Interpretation Conflict
cwe-id: CWE-626
definition: The product does not properly handle null bytes or NUL characters when passing data between different representations or components.

Dynamic Variable Evaluation
type: Class
subclass of: Improper Control of Dynamically-Identified Variables
cwe-id: CWE-627
definition: In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
synonym: Dynamic evaluation

Function Call with Incorrectly Specified Arguments
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-628
definition: The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

Not Failing Securely ('Failing Open')
type: Class
subclass of: Violation of Secure Design Principles
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-636
definition: When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
synonym: Failing Open

Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
type: Class
subclass of: Violation of Secure Design Principles
cwe-id: CWE-637
definition: The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.
synonym: Unnecessary Complexity

Not Using Complete Mediation
type: Class
subclass of: Violation of Secure Design Principles
subclass of: Missing Authorization
cwe-id: CWE-638
definition: The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.

Authorization Bypass Through User-Controlled Key
type: Class
subclass of: Incorrect Authorization
cwe-id: CWE-639
definition: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
synonym: Broken Object Level Authorization / BOLA
synonym: Horizontal Authorization
synonym: Insecure Direct Object Reference / IDOR

Windows Shortcut Following (.LNK)
type: Class
subclass of: Improper Link Resolution Before File Access ('Link Following')
cwe-id: CWE-64
definition: The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
synonym: Windows symbolic link following
synonym: symlink

Weak Password Recovery Mechanism for Forgotten Password
type: Class
subclass of: Weak Authentication
cwe-id: CWE-640
definition: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Improper Restriction of Names for Files and Other Resources
type: Class
subclass of: Improper Control of Resource Identifiers ('Resource Injection')
cwe-id: CWE-641
definition: The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.

External Control of Critical State Data
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-642
definition: The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

Improper Neutralization of Data within XPath Expressions ('XPath Injection')
type: Class
subclass of: XML Injection (aka Blind XPath Injection)
subclass of: Improper Neutralization of Special Elements in Data Query Logic
cwe-id: CWE-643
definition: The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Improper Neutralization of HTTP Headers for Scripting Syntax
type: Class
subclass of: Improper Encoding or Escaping of Output
cwe-id: CWE-644
definition: The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Overly Restrictive Account Lockout Mechanism
type: Class
subclass of: Improper Authentication
cwe-id: CWE-645
definition: The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.

Reliance on File Name or Extension of Externally-Supplied File
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-646
definition: The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

Use of Non-Canonical URL Paths for Authorization Decisions
type: Class
subclass of: Incorrect Authorization
cwe-id: CWE-647
definition: The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

Incorrect Use of Privileged APIs
type: Class
subclass of: Improper Privilege Management
cwe-id: CWE-648
definition: The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-649
definition: The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified.

Windows Hard Link
type: Class
subclass of: Improper Link Resolution Before File Access ('Link Following')
cwe-id: CWE-65
definition: The product, when opening a file or directory, does not sufficiently handle when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Trusting HTTP Permission Methods on the Server Side
type: Class
subclass of: Interpretation Conflict
cwe-id: CWE-650
definition: The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.

Exposure of WSDL File Containing Sensitive Information
type: Class
subclass of: Insertion of Sensitive Information into Externally-Accessible File or Directory
cwe-id: CWE-651
definition: The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).

Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
type: Class
subclass of: XML Injection (aka Blind XPath Injection)
subclass of: Improper Neutralization of Special Elements in Data Query Logic
cwe-id: CWE-652
definition: The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Improper Isolation or Compartmentalization
type: Class
subclass of: Violation of Secure Design Principles
subclass of: Protection Mechanism Failure
cwe-id: CWE-653
definition: The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
synonym: Separation of Privilege

Reliance on a Single Factor in a Security Decision
type: Class
subclass of: Violation of Secure Design Principles
subclass of: Protection Mechanism Failure
cwe-id: CWE-654
definition: A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
synonym: Separation of Privilege

Insufficient Psychological Acceptability
type: Class
subclass of: Violation of Secure Design Principles
subclass of: Protection Mechanism Failure
cwe-id: CWE-655
definition: The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

Reliance on Security Through Obscurity
type: Class
subclass of: Violation of Secure Design Principles
subclass of: Protection Mechanism Failure
cwe-id: CWE-656
definition: The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
synonym: Never Assuming your secrets are safe

Violation of Secure Design Principles
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-657
definition: The product violates well-established principles for secure design.

Improper Handling of File Names that Identify Virtual Resources
type: Class
subclass of: Use of Incorrectly-Resolved Name or Reference
cwe-id: CWE-66
definition: The product does not handle or incorrectly handles a file name that identifies a "virtual" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.

Improper Synchronization
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
subclass of: Insufficient Control Flow Management
cwe-id: CWE-662
definition: The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

Use of a Non-reentrant Function in a Concurrent Context
type: Class
subclass of: Improper Synchronization
cwe-id: CWE-663
definition: The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.

Improper Control of a Resource Through its Lifetime
type: Class
subclass of: Weakness
cwe-id: CWE-664
definition: The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Improper Initialization
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-665
definition: The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Operation on Resource in Wrong Phase of Lifetime
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-666
definition: The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

Improper Locking
type: Class
subclass of: Improper Synchronization
cwe-id: CWE-667
definition: The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Exposure of Resource to Wrong Sphere
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-668
definition: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Incorrect Resource Transfer Between Spheres
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-669
definition: The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Improper Handling of Windows Device Names
type: Class
subclass of: Improper Handling of File Names that Identify Virtual Resources
cwe-id: CWE-67
definition: The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

Always-Incorrect Control Flow Implementation
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-670
definition: The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Lack of Administrator Control over Security
type: Class
subclass of: Violation of Secure Design Principles
cwe-id: CWE-671
definition: The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

Operation on a Resource after Expiration or Release
type: Class
subclass of: Operation on Resource in Wrong Phase of Lifetime
cwe-id: CWE-672
definition: The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

External Influence of Sphere Definition
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-673
definition: The product does not prevent the definition of control spheres from external actors.

Uncontrolled Recursion
type: Class
subclass of: Excessive Iteration
cwe-id: CWE-674
definition: The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
synonym: Stack Exhaustion

Multiple Operations on Resource in Single-Operation Context
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-675
definition: The product performs the same operation on a resource two or more times, when the operation should only be applied once.

Use of Potentially Dangerous Function
type: Class
subclass of: Use of Prohibited Code
cwe-id: CWE-676
definition: The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

Integer Overflow to Buffer Overflow
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
subclass of: Integer Overflow or Wraparound
cwe-id: CWE-680
definition: The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

Incorrect Conversion between Numeric Types
type: Class
subclass of: Incorrect Type Conversion or Cast
cwe-id: CWE-681
definition: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Incorrect Calculation
type: Class
subclass of: Weakness
cwe-id: CWE-682
definition: The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Function Call With Incorrect Order of Arguments
type: Class
subclass of: Function Call with Incorrectly Specified Arguments
cwe-id: CWE-683
definition: The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.

Incorrect Provision of Specified Functionality
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-684
definition: The code does not function according to its published specifications, potentially leading to incorrect usage.

Function Call With Incorrect Number of Arguments
type: Class
subclass of: Function Call with Incorrectly Specified Arguments
cwe-id: CWE-685
definition: The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.

Function Call With Incorrect Argument Type
type: Class
subclass of: Function Call with Incorrectly Specified Arguments
cwe-id: CWE-686
definition: The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.

Function Call With Incorrectly Specified Argument Value
type: Class
subclass of: Function Call with Incorrectly Specified Arguments
cwe-id: CWE-687
definition: The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.

Function Call With Incorrect Variable or Reference as Argument
type: Class
subclass of: Function Call with Incorrectly Specified Arguments
cwe-id: CWE-688
definition: The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.

Permission Race Condition During Resource Copy
type: Class
subclass of: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
cwe-id: CWE-689
definition: The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.

Improper Handling of Windows ::DATA Alternate Data Stream
type: Class
subclass of: Improper Handling of File Names that Identify Virtual Resources
cwe-id: CWE-69
definition: The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Unchecked Return Value to NULL Pointer Dereference
type: Class
subclass of: Unchecked Return Value
subclass of: NULL Pointer Dereference
cwe-id: CWE-690
definition: The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.

Insufficient Control Flow Management
type: Class
subclass of: Weakness
cwe-id: CWE-691
definition: The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Incomplete Denylist to Cross-Site Scripting
type: Class
subclass of: Incomplete List of Disallowed Inputs
subclass of: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe-id: CWE-692
definition: The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Protection Mechanism Failure
type: Class
subclass of: Weakness
cwe-id: CWE-693
definition: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Use of Multiple Resources with Duplicate Identifier
type: Class
subclass of: Improper Following of Specification by Caller
subclass of: Improper Control of Resource Identifiers ('Resource Injection')
cwe-id: CWE-694
definition: The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Use of Low-Level Functionality
type: Class
subclass of: Improper Following of Specification by Caller
cwe-id: CWE-695
definition: The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate.

Incorrect Behavior Order
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-696
definition: The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.

Incorrect Comparison
type: Class
subclass of: Weakness
cwe-id: CWE-697
definition: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

Execution After Redirect (EAR)
type: Class
subclass of: Always-Incorrect Control Flow Implementation
subclass of: Incorrect Control Flow Scoping
cwe-id: CWE-698
definition: The web application sends a redirect to another location, but instead of exiting, it executes additional code.
synonym: Redirect Without Exit

J2EE Misconfiguration: Missing Custom Error Page
type: Class
subclass of: Missing Custom Error Page
cwe-id: CWE-7
definition: The default error page of a web application should not display sensitive information about the product.

Improper Check or Handling of Exceptional Conditions
type: Class
subclass of: Weakness
cwe-id: CWE-703
definition: The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Incorrect Type Conversion or Cast
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-704
definition: The product does not correctly convert an object, resource, or structure from one type to a different type.

Incorrect Control Flow Scoping
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-705
definition: The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

Use of Incorrectly-Resolved Name or Reference
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-706
definition: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Improper Neutralization
type: Class
subclass of: Weakness
cwe-id: CWE-707
definition: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Incorrect Ownership Assignment
type: Class
subclass of: Improper Ownership Management
cwe-id: CWE-708
definition: The product assigns an owner to a resource, but the owner is outside of the intended control sphere.

Improper Adherence to Coding Standards
type: Class
subclass of: Weakness
cwe-id: CWE-710
definition: The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Improper Handling of Apple HFS+ Alternate Data Stream Path
type: Class
subclass of: Improper Handling of File Names that Identify Virtual Resources
cwe-id: CWE-72
definition: The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system.

External Control of File Name or Path
type: Class
subclass of: Externally Controlled Reference to a Resource in Another Sphere
subclass of: External Control of Critical State Data
cwe-id: CWE-73
definition: The product allows user input to control or influence paths or file names that are used in filesystem operations.

Incorrect Permission Assignment for Critical Resource
type: Class
subclass of: Improper Authorization
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-732
definition: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Compiler Optimization Removal or Modification of Security-critical Code
type: Class
subclass of: Insecure Automated Optimizations
cwe-id: CWE-733
definition: The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
type: Class
subclass of: Improper Neutralization
cwe-id: CWE-74
definition: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Exposed Dangerous Method or Function
type: Class
subclass of: Improper Access Control
cwe-id: CWE-749
definition: The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
cwe-id: CWE-75
definition: The product does not adequately filter user-controlled input for special elements with control implications.

Improper Check for Unusual or Exceptional Conditions
type: Class
subclass of: Improper Check or Handling of Exceptional Conditions
cwe-id: CWE-754
definition: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Improper Handling of Exceptional Conditions
type: Class
subclass of: Improper Check or Handling of Exceptional Conditions
cwe-id: CWE-755
definition: The product does not handle or incorrectly handles an exceptional condition.

Missing Custom Error Page
type: Class
subclass of: Improper Handling of Exceptional Conditions
cwe-id: CWE-756
definition: The product does not return custom error pages to the user, possibly exposing sensitive information.

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-757
definition: A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
type: Class
subclass of: Improper Adherence to Coding Standards
cwe-id: CWE-758
definition: The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

Use of a One-Way Hash without a Salt
type: Class
subclass of: Use of Password Hash With Insufficient Computational Effort
cwe-id: CWE-759
definition: The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

Improper Neutralization of Equivalent Special Elements
type: Class
subclass of: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
cwe-id: CWE-76
definition: The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

Use of a One-Way Hash with a Predictable Salt
type: Class
subclass of: Use of Password Hash With Insufficient Computational Effort
cwe-id: CWE-760
definition: The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

Free of Pointer not at Start of Buffer
type: Class
subclass of: Release of Invalid Pointer or Reference
subclass of: Restriction
  on property: weakness-of
  some values from: Memory Free Function
type: NamedIndividual
weakness-of: Memory Free Function
cwe-id: CWE-761
definition: The product calls free() on a pointer to a memory resource that was allocated on the heap, but the pointer is not at the start of the buffer.

Mismatched Memory Management Routines
type: Class
subclass of: Release of Invalid Pointer or Reference
cwe-id: CWE-762
definition: The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

Release of Invalid Pointer or Reference
type: Class
subclass of: Improper Resource Shutdown or Release
cwe-id: CWE-763
definition: The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

Multiple Locks of a Critical Resource
type: Class
subclass of: Improper Locking
subclass of: Multiple Operations on Resource in Single-Operation Context
cwe-id: CWE-764
definition: The product locks a critical resource more times than intended, leading to an unexpected state in the system.

Multiple Unlocks of a Critical Resource
type: Class
subclass of: Improper Locking
subclass of: Multiple Operations on Resource in Single-Operation Context
cwe-id: CWE-765
definition: The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.

Critical Data Element Declared Public
type: Class
subclass of: Insufficient Encapsulation
subclass of: Incorrect Permission Assignment for Critical Resource
cwe-id: CWE-766
definition: The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.

Access to Critical Private Variable via Public Method
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-767
definition: The product defines a public method that reads or modifies a private variable.

Incorrect Short Circuit Evaluation
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-768
definition: The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects. This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring.

Improper Neutralization of Special Elements used in a Command ('Command Injection')
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
synonym: Command injection
cwe-id: CWE-77
definition: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Allocation of Resources Without Limits or Throttling
type: Class
subclass of: Uncontrolled Resource Consumption
subclass of: Improper Initialization
cwe-id: CWE-770
definition: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

Missing Reference to Active Allocated Resource
type: Class
subclass of: Uncontrolled Resource Consumption
cwe-id: CWE-771
definition: The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.

Missing Release of Resource after Effective Lifetime
type: Class
subclass of: Improper Resource Shutdown or Release
cwe-id: CWE-772
definition: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Missing Reference to Active File Descriptor or Handle
type: Class
subclass of: Missing Reference to Active Allocated Resource
cwe-id: CWE-773
definition: The product does not properly maintain references to a file descriptor or handle, which prevents that file descriptor/handle from being reclaimed.

Allocation of File Descriptors or Handles Without Limits or Throttling
type: Class
subclass of: Allocation of Resources Without Limits or Throttling
cwe-id: CWE-774
definition: The product allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor.
synonym: File Descriptor Exhaustion

Missing Release of File Descriptor or Handle after Effective Lifetime
type: Class
subclass of: Missing Release of Resource after Effective Lifetime
cwe-id: CWE-775
definition: The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
type: Class
subclass of: Asymmetric Resource Consumption (Amplification)
subclass of: Uncontrolled Recursion
cwe-id: CWE-776
definition: The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
synonym: Billion Laughs Attack
synonym: XEE
synonym: XML Bomb

Regular Expression without Anchors
type: Class
subclass of: Permissive Regular Expression
cwe-id: CWE-777
definition: The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.

Insufficient Logging
type: Class
subclass of: Omission of Security-relevant Information
subclass of: Protection Mechanism Failure
cwe-id: CWE-778
definition: When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Logging of Excessive Data
type: Class
subclass of: Uncontrolled Resource Consumption
cwe-id: CWE-779
definition: The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
type: Class
subclass of: Improper Neutralization of Special Elements used in a Command ('Command Injection')
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: Eval Function
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: Process Start Function
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: UserInputFunction
type: NamedIndividual
may-be-weakness-of: Eval Function
may-be-weakness-of: Process Start Function
may-be-weakness-of: UserInputFunction
synonym: Shell metacharacters
cwe-id: CWE-78
definition: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
synonym: Shell injection
synonym: OS Command Injection

Use of RSA Algorithm without OAEP
type: Class
subclass of: Use of a Broken or Risky Cryptographic Algorithm
cwe-id: CWE-780
definition: The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.

Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
type: Class
subclass of: Improper Validation of Specified Index, Position, or Offset in Input
cwe-id: CWE-781
definition: The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided.

Exposed IOCTL with Insufficient Access Control
type: Class
subclass of: Exposed Dangerous Method or Function
cwe-id: CWE-782
definition: The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.

Operator Precedence Logic Error
type: Class
subclass of: Always-Incorrect Control Flow Implementation
cwe-id: CWE-783
definition: The product uses an expression in which operator precedence causes incorrect logic to be used.

Reliance on Cookies without Validation and Integrity Checking in a Security Decision
type: Class
subclass of: Reliance on Cookies without Validation and Integrity Checking
subclass of: Reliance on Untrusted Inputs in a Security Decision
cwe-id: CWE-784
definition: The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.

Use of Path Manipulation Function without Maximum-sized Buffer
type: Class
subclass of: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
subclass of: Use of Potentially Dangerous Function
cwe-id: CWE-785
definition: The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.

Access of Memory Location Before Start of Buffer
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
cwe-id: CWE-786
definition: The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Out-of-bounds Write
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
subclass of: Restriction
  on property: weakness-of
  some values from: Raw Memory Access Function
type: NamedIndividual
weakness-of: Raw Memory Access Function
definition: The product writes data past the end, or before the beginning, of the intended buffer.
cwe-id: CWE-787
synonym: Memory Corruption

Access of Memory Location After End of Buffer
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
cwe-id: CWE-788
definition: The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.

Memory Allocation with Excessive Size Value
type: Class
subclass of: Improper Validation of Specified Quantity in Input
subclass of: Allocation of Resources Without Limits or Throttling
cwe-id: CWE-789
definition: The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
synonym: Stack Exhaustion

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
synonym: Stored XSS / Persistent XSS / Type 2 XSS
synonym: HTML Injection
cwe-id: CWE-79
synonym: XSS
synonym: Reflected XSS / Non-Persistent XSS / Type 1 XSS
synonym: DOM-Based XSS / Type 0 XSS
synonym: CSS
definition: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Improper Filtering of Special Elements
type: Class
subclass of: Improper Neutralization of Special Elements
cwe-id: CWE-790
definition: The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.

Incomplete Filtering of Special Elements
type: Class
subclass of: Improper Filtering of Special Elements
cwe-id: CWE-791
definition: The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

Incomplete Filtering of One or More Instances of Special Elements
type: Class
subclass of: Incomplete Filtering of Special Elements
cwe-id: CWE-792
definition: The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.

Only Filtering One Instance of a Special Element
type: Class
subclass of: Incomplete Filtering of One or More Instances of Special Elements
cwe-id: CWE-793
definition: The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.

Incomplete Filtering of Multiple Instances of Special Elements
type: Class
subclass of: Incomplete Filtering of One or More Instances of Special Elements
cwe-id: CWE-794
definition: The product receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component.

Only Filtering Special Elements at a Specified Location
type: Class
subclass of: Incomplete Filtering of Special Elements
cwe-id: CWE-795
definition: The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.

Only Filtering Special Elements Relative to a Marker
type: Class
subclass of: Only Filtering Special Elements at a Specified Location
cwe-id: CWE-796
definition: The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. "at the beginning/end of a string; the second argument"), thereby missing remaining special elements that may exist before sending it to a downstream component.

Only Filtering Special Elements at an Absolute Position
type: Class
subclass of: Only Filtering Special Elements at a Specified Location
cwe-id: CWE-797
definition: The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component.

Use of Hard-coded Credentials
type: Class
subclass of: Use of Weak Credentials
subclass of: Use of Invariant Value in Dynamically Changing Context
subclass of: Lack of Administrator Control over Security
subclass of: Restriction
  on property: weakness-of
  some values from: Authentication Function
type: NamedIndividual
weakness-of: Authentication Function
cwe-id: CWE-798
definition: The product contains hard-coded credentials, such as a password or cryptographic key.

Improper Control of Interaction Frequency
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-799
definition: The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
synonym: Brute force
synonym: Insufficient anti-automation

J2EE Misconfiguration: Entity Bean Declared Remote
type: Class
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-8
definition: When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
type: Class
subclass of: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe-id: CWE-80
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Guessable CAPTCHA
type: Class
subclass of: Weak Authentication
subclass of: Incorrect Authorization
cwe-id: CWE-804
definition: The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

Buffer Access with Incorrect Length Value
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
cwe-id: CWE-805
definition: The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

Buffer Access Using Size of Source Buffer
type: Class
subclass of: Buffer Access with Incorrect Length Value
cwe-id: CWE-806
definition: The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.

Reliance on Untrusted Inputs in a Security Decision
type: Class
subclass of: Protection Mechanism Failure
cwe-id: CWE-807
definition: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Improper Neutralization of Script in an Error Message Web Page
type: Class
subclass of: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe-id: CWE-81
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
type: Class
subclass of: Improper Neutralization of Script in Attributes in a Web Page
cwe-id: CWE-82
definition: The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Missing Synchronization
type: Class
subclass of: Improper Synchronization
cwe-id: CWE-820
definition: The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

Incorrect Synchronization
type: Class
subclass of: Improper Synchronization
cwe-id: CWE-821
definition: The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

Untrusted Pointer Dereference
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
subclass of: Restriction
  on property: weakness-of
  some values from: Pointer Dereferencing Function
type: NamedIndividual
weakness-of: Pointer Dereferencing Function
definition: The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
cwe-id: CWE-822

Use of Out-of-range Pointer Offset
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
cwe-id: CWE-823
definition: The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
synonym: Untrusted pointer offset

Access of Uninitialized Pointer
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
subclass of: Restriction
  on property: weakness-of
  some values from: Pointer Dereferencing Function
type: NamedIndividual
weakness-of: Pointer Dereferencing Function
cwe-id: CWE-824
definition: The product accesses or uses a pointer that has not been initialized.

Expired Pointer Dereference
type: Class
subclass of: Improper Restriction of Operations within the Bounds of a Memory Buffer
subclass of: Operation on a Resource after Expiration or Release
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
cwe-id: CWE-825
definition: The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
synonym: Dangling pointer

Premature Release of Resource During Expected Lifetime
type: Class
subclass of: Operation on Resource in Wrong Phase of Lifetime
cwe-id: CWE-826
definition: The product releases a resource that is still intended to be used by itself or another actor.

Improper Control of Document Type Definition
type: Class
subclass of: Use of Incorrectly-Resolved Name or Reference
subclass of: Inclusion of Functionality from Untrusted Control Sphere
cwe-id: CWE-827
definition: The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

Signal Handler with Functionality that is not Asynchronous-Safe
type: Class
subclass of: Signal Handler Race Condition
cwe-id: CWE-828
definition: The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.

Inclusion of Functionality from Untrusted Control Sphere
type: Class
subclass of: Incorrect Resource Transfer Between Spheres
cwe-id: CWE-829
definition: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Improper Neutralization of Script in Attributes in a Web Page
type: Class
subclass of: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe-id: CWE-83
definition: The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

Inclusion of Web Functionality from an Untrusted Source
type: Class
subclass of: Inclusion of Functionality from Untrusted Control Sphere
cwe-id: CWE-830
definition: The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.

Signal Handler Function Associated with Multiple Signals
type: Class
subclass of: Signal Handler Race Condition
cwe-id: CWE-831
definition: The product defines a function that is used as a handler for more than one signal.

Unlock of a Resource that is not Locked
type: Class
subclass of: Improper Locking
cwe-id: CWE-832
definition: The product attempts to unlock a resource that is not locked.

Deadlock
type: Class
subclass of: Improper Locking
cwe-id: CWE-833
definition: The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Excessive Iteration
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-834
definition: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Loop with Unreachable Exit Condition ('Infinite Loop')
type: Class
subclass of: Excessive Iteration
cwe-id: CWE-835
definition: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Use of Password Hash Instead of Password for Authentication
type: Class
subclass of: Weak Authentication
cwe-id: CWE-836
definition: The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

Improper Enforcement of a Single, Unique Action
type: Class
subclass of: Improper Control of Interaction Frequency
cwe-id: CWE-837
definition: The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.

Inappropriate Encoding for Output Context
type: Class
subclass of: Improper Encoding or Escaping of Output
cwe-id: CWE-838
definition: The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.

Numeric Range Comparison Without Minimum Check
type: Class
subclass of: Incomplete Comparison with Missing Factors
cwe-id: CWE-839
definition: The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
synonym: Signed comparison

Improper Neutralization of Encoded URI Schemes in a Web Page
type: Class
subclass of: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe-id: CWE-84
definition: The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

Improper Enforcement of Behavioral Workflow
type: Class
subclass of: Insufficient Control Flow Management
cwe-id: CWE-841
definition: The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Placement of User into Incorrect Group
type: Class
subclass of: Incorrect User Management
cwe-id: CWE-842
definition: The product or the administrator places a user into an incorrect group.

Access of Resource Using Incompatible Type ('Type Confusion')
type: Class
subclass of: Incorrect Type Conversion or Cast
cwe-id: CWE-843
definition: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
synonym: Object Type Confusion

Doubled Character XSS Manipulations
type: Class
subclass of: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe-id: CWE-85
definition: The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

Improper Neutralization of Invalid Characters in Identifiers in Web Pages
type: Class
subclass of: Interpretation Conflict
subclass of: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe-id: CWE-86
definition: The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

Missing Authorization
type: Class
subclass of: Improper Authorization
cwe-id: CWE-862
definition: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
synonym: AuthZ
comment: Broad and could apply to all resource accesses.

Incorrect Authorization
type: Class
subclass of: Improper Authorization
cwe-id: CWE-863
definition: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
synonym: AuthZ

Improper Neutralization of Alternate XSS Syntax
type: Class
subclass of: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe-id: CWE-87
definition: The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
type: Class
subclass of: Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe-id: CWE-88
definition: The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: Class
subclass of: Improper Neutralization of Special Elements in Data Query Logic
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
synonym: SQLi
cwe-id: CWE-89
definition: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
synonym: SQL injection

J2EE Misconfiguration: Weak Access Permissions for EJB Methods
type: Class
subclass of: Incorrect Privilege Assignment
cwe-id: CWE-9
definition: If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
type: Class
subclass of: Improper Neutralization of Special Elements in Data Query Logic
cwe-id: CWE-90
definition: The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Use of Uninitialized Resource
type: Class
subclass of: Improper Initialization
cwe-id: CWE-908
definition: The product uses or accesses a resource that has not been initialized.

Missing Initialization of Resource
type: Class
subclass of: Improper Initialization
cwe-id: CWE-909
definition: The product does not initialize a critical resource.

XML Injection (aka Blind XPath Injection)
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
cwe-id: CWE-91
definition: The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Use of Expired File Descriptor
type: Class
subclass of: Operation on a Resource after Expiration or Release
cwe-id: CWE-910
definition: The product uses or accesses a file descriptor after it has been closed.
synonym: Stale file descriptor

Improper Update of Reference Count
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-911
definition: The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.

Hidden Functionality
type: Class
subclass of: Incorrect Provision of Specified Functionality
cwe-id: CWE-912
definition: The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

Improper Control of Dynamically-Managed Code Resources
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-913
definition: The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Improper Control of Dynamically-Identified Variables
type: Class
subclass of: Improper Control of Dynamically-Managed Code Resources
subclass of: Improper Control of Resource Identifiers ('Resource Injection')
cwe-id: CWE-914
definition: The product does not properly restrict reading from or writing to dynamically-identified variables.

Improperly Controlled Modification of Dynamically-Determined Object Attributes
type: Class
subclass of: Improper Control of Dynamically-Managed Code Resources
cwe-id: CWE-915
definition: The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
synonym: AutoBinding
synonym: Mass Assignment
synonym: PHP Object Injection

Use of Password Hash With Insufficient Computational Effort
type: Class
subclass of: Use of a Broken or Risky Cryptographic Algorithm
subclass of: Use of Weak Hash
cwe-id: CWE-916
definition: The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
type: Class
subclass of: Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe-id: CWE-917
definition: The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
synonym: EL Injection

Server-Side Request Forgery (SSRF)
type: Class
subclass of: Unintended Proxy or Intermediary ('Confused Deputy')
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
type: NamedIndividual
weakness-of: UserInputFunction
synonym: SSRF
cwe-id: CWE-918
definition: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
synonym: XSPA

Improper Restriction of Power Consumption
type: Class
subclass of: Uncontrolled Resource Consumption
cwe-id: CWE-920
definition: The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes.

Storage of Sensitive Data in a Mechanism without Access Control
type: Class
subclass of: Insecure Storage of Sensitive Information
cwe-id: CWE-921
definition: The product stores sensitive information in a file system or device that does not have built-in access control.

Insecure Storage of Sensitive Information
type: Class
subclass of: Improper Control of a Resource Through its Lifetime
cwe-id: CWE-922
definition: The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Improper Restriction of Communication Channel to Intended Endpoints
type: Class
subclass of: Improper Access Control
cwe-id: CWE-923
definition: The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Improper Enforcement of Message Integrity During Transmission in a Communication Channel
type: Class
subclass of: Insufficient Verification of Data Authenticity
cwe-id: CWE-924
definition: The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.

Improper Verification of Intent by Broadcast Receiver
type: Class
subclass of: Improper Verification of Source of a Communication Channel
cwe-id: CWE-925
definition: The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
synonym: Intent Spoofing

Improper Export of Android Application Components
type: Class
subclass of: Improper Authorization
cwe-id: CWE-926
definition: The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Use of Implicit Intent for Sensitive Communication
type: Class
subclass of: Improper Authorization
subclass of: Exposure of Resource to Wrong Sphere
cwe-id: CWE-927
definition: The Android application uses an implicit intent for transmitting sensitive data to other applications.

Improper Neutralization of CRLF Sequences ('CRLF Injection')
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
cwe-id: CWE-93
definition: The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Improper Authorization in Handler for Custom URL Scheme
type: Class
subclass of: Missing Authorization
cwe-id: CWE-939
definition: The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

Improper Control of Generation of Code ('Code Injection')
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
subclass of: Improper Control of Dynamically-Managed Code Resources
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: Eval Function
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: UserInputFunction
type: NamedIndividual
may-be-weakness-of: Eval Function
may-be-weakness-of: UserInputFunction
synonym: Code Injection
definition: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
cwe-id: CWE-94

Improper Verification of Source of a Communication Channel
type: Class
subclass of: Origin Validation Error
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-940
definition: The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Incorrectly Specified Destination in a Communication Channel
type: Class
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-941
definition: The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

Permissive Cross-domain Policy with Untrusted Domains
type: Class
subclass of: Permissive List of Allowed Inputs
subclass of: Incorrect Authorization
subclass of: Improper Restriction of Communication Channel to Intended Endpoints
cwe-id: CWE-942
definition: The product uses a cross-domain policy file that includes domains that should not be trusted.

Improper Neutralization of Special Elements in Data Query Logic
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
cwe-id: CWE-943
definition: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
synonym: NoSQL Injection, NoSQLi

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
type: Class
subclass of: Improper Control of Generation of Code ('Code Injection')
cwe-id: CWE-95
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
type: Class
subclass of: Improper Control of Generation of Code ('Code Injection')
cwe-id: CWE-96
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
type: Class
subclass of: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
cwe-id: CWE-97
definition: The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
type: Class
subclass of: Use of Incorrectly-Resolved Name or Reference
subclass of: Inclusion of Functionality from Untrusted Control Sphere
cwe-id: CWE-98
definition: The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
synonym: Local file inclusion
synonym: RFI
synonym: Remote file include

Improper Control of Resource Identifiers ('Resource Injection')
type: Class
subclass of: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
cwe-id: CWE-99
definition: The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
synonym: Insecure Direct Object Reference

Processor Cache Memory
type: Class
subclass of: Primary Storage
subclass of: Restriction
  on property: accessed-by
  some values from: Central Processing Unit
subclass of: Restriction
  on property: may-contain
  some values from: Process Segment
subclass of: Restriction
  on property: modifies
  some values from: Processor Cache Memory
type: NamedIndividual
accessed-by: Central Processing Unit
may-contain: Process Segment
definition: Cache memory is temporary storage that is more readily available to the processor than the computer's main memory source, located between the main memory and the processor. It is typically either integrated directly into the CPU chip (level 1 cache) or placed on a separate chip with a bus interconnect with the CPU (level 2 cache).

Call Stack
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Stack Frame
type: NamedIndividual
contains: Stack Frame
definition: In computer science, a call stack is a stack data structure that stores information about the active subroutines of a computer program. This kind of stack is also known as an execution stack, program stack, control stack, run-time stack, or machine stack, and is often shortened to just "the stack". Although maintenance of the call stack is important for the proper functioning of most software, the details are normally hidden and automatic in high-level programming languages. Many computer instruction sets provide special instructions for manipulating stacks.

Canopy Clustering
type: Class
subclass of: Cluster Analysis
type: NamedIndividual
d3fend-id: D3A-CC
kb-article: ## References Wikipedia. (n.d.). Canopy clustering algorithm. [Link](https://en.wikipedia.org/wiki/Canopy_clustering_algorithm)
definition: The canopy clustering algorithm is an unsupervised pre-clustering algorithm often used as preprocessing step for the K-means algorithm or the Hierarchical clustering algorithm. It is intended to speed up clustering operations on large data sets.

Capability
type: Class
subclass of: External Thing

Central Processing Unit
type: Class
subclass of: Processor
subclass of: Restriction
  on property: contains
  some values from: Processor Register
subclass of: Restriction
  on property: may-contain
  some values from: Processor Cache Memory
subclass of: Restriction
  on property: may-contain
  some values from: Memory Management Unit
subclass of: Restriction
  on property: may-contain
  some values from: Memory Protection Unit
type: NamedIndividual
contains: Processor Register
may-contain: Processor Cache Memory
may-contain: Memory Management Unit
may-contain: Memory Protection Unit
synonym: CPU
synonym: Central Processor
definition: A central processing unit (CPU), also called a central processor, main processor or just processor, is the electronic circuitry that executes instructions comprising a computer program. The CPU performs basic arithmetic, logic, controlling, and input/output (I/O) operations specified by the instructions in the program. This contrasts with external components such as main memory and I/O circuitry, and specialized processors such as graphics
synonym: Main Processor

Central Tendency
type: Class
subclass of: Descriptive Statistics
type: NamedIndividual
d3fend-id: D3A-CT
kb-article: ## References Australian Bureau of Statistics. (n.d.). Measures of Central Tendency. [Link](https://www.abs.gov.au/statistics/understanding-statistics/statistical-terms-and-concepts/measures-central-tendency) Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
definition: A measure of central tendency ) is a summary measure that attempts to describe a whole set of data with a single value that represents the middle or centre of its distribution.

Centroid-based Clustering
type: Class
subclass of: Cluster Analysis
type: NamedIndividual
d3fend-id: D3A-CBC
definition: Centroid-based clustering organizes the data into non-hierarchical clusters, in contrast to hierarchical clustering defined below. K-means is the most widely-used centroid-based clustering algorithm. Centroid-based algorithms are efficient but sensitive to initial conditions and outliers.
kb-article: ## References Google Developers. (n.d.). Clustering Algorithms. [Link](https://developers.google.com/machine-learning/clustering/clustering-algorithms)

Certificate
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Identifier
subclass of: Restriction
  on property: contains
  some values from: Public Key
type: NamedIndividual
contains: Identifier
contains: Public Key
definition: In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ownership of a public key. The certificate includes information about the key, information about the identity of its owner (called the subject), and the digital signature of an entity that has verified the certificate's contents (called the issuer). If the signature is valid, and the software examining the certificate trusts the issuer, then it can use that key to communicate securely with the certificate's subject. In email encryption, code signing, and e-signature systems, a certificate's subject is typically a person or organization. However, in Transport Layer Security (TLS) a certificate's subject is typically a computer or other device.
alternative label: Public Key Certificate

Certificate-based Authentication
type: Class
subclass of: Agent Authentication
subclass of: Restriction
  on property: reads
  some values from: Certificate
type: NamedIndividual
kb-reference: Reference-FederalPublicKeyInfrastructure101
reads: Certificate
d3fend-id: D3-CBAN
definition: Requiring a digital certificate in order to authenticate a user.
kb-article: ## How it works Certificate-based authentication is a security mechanism that uses digital certificates to verify the identity of a user, device, or server before granting access to a network or system. This method relies on a pair of cryptographic keys: a public key and a private key. ## Considerations * Private Key Protection: Ensure that private keys are securely stored and protected against unauthorized access. * Certificate Revocation: Implement a robust process for revoking certificates if they are compromised or no longer needed. * Man-in-the Middle Attacks: Use mutual authentication to mitigate the risk of these attacks.

Certificate Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Certificate File
type: NamedIndividual
analyzes: Certificate File
kb-reference: Reference-SecuringWebTransactions
d3fend-id: D3-CA
kb-article: ## How it works Certificate Analysis ensures that the data elements of the certificate are current and anchored in a known trust model. Certificate authorities, revocation lists, and third-party secure logs are used in the analysis. Analysis includes detection of server impersonation, phishing domains, and forged certificates. TLS certificates are designed to expire to ensure that the cryptographic keys are forced to be changed on a regular basis. The certificates in the trust path also expire and can cause a break in the trust chain. This means that even if a server certificate is updated correctly, intermediate certificates can expire and the trust chain is not maintained. This can cause services to become unavailable.
definition: Analyzing Public Key Infrastructure certificates to detect if they have been misconfigured or spoofed using both network traffic, certificate fields and third-party logs.

Certificate File
type: Class
subclass of: File
subclass of: Restriction
  on property: contains
  some values from: Certificate
type: NamedIndividual
contains: Certificate
definition: A file containing a digital certificate. In cryptography, a public key certificate (also known as a digital certificate or identity certificate) is an electronic document used to prove the ownership of a public key. The certificate includes information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

Certificate Pinning
type: Class
subclass of: Credential Hardening
subclass of: Restriction
  on property: authenticates
  some values from: Public Key
subclass of: Restriction
  on property: hardens
  some values from: Certificate
type: NamedIndividual
authenticates: Public Key
hardens: Certificate
kb-reference: Reference-CertificateAndPublicKeyPinning
kb-reference: Reference-End-to-endCertificatePinning
kb-reference: Reference-PublicKeyPinningExtensionForHTTP
d3fend-id: D3-CP
definition: Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections.
kb-article: ## How it works Pinning allows for a trusted copy of a certificate or public key to be associated with a server and thus reducing the likelihood of frequently visited sites being subjected to man-in-the-middle attacks. Certificates or public keys can be pinned after a trusted connection has been established or the pinning can be preloaded in an application, which is the preferred method for mobile applications. Pinning can take the form of certificate pinning or public key pinning. ## Forms of Pinning * Certificate Pinning (CP) allows for the client to verify the X.509 certificate with a preloaded certificate. Typically, this is involves storing a hash of the certificate and using the stored hash for comparison to the hash of the certificate submitted during the SSL handshake. * Public Key Pinning (PKP) requires the extraction of a public key from server's certificate. The stored public key is compared to the server's presented public key. A public key is expected to rotate less frequently than an X.509 certificate and is generally favored over certificate pinning. An extension of PKP is Subject Public Key Information Pinning (SPKI) includes public key pinning plus additional information for SSL connections. The additional information can include preferred algorithms. ## Considerations * With pinned certificates whenever a server updates its certificate, the pinned certificates will also need to be updated * With pinned public keys the extracted key may be subject to key refresh policies but much less frequently * Servers can become unavailable if pinned objects are set and not updated with the rotated identities. This may require a pinning strategy to be developed. * The application of this technique within web browser applications has been [deprecated](https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning) by popular web browser developers. They now favor certificate analysis via public certificate transparency logs, and the EXPECT-CT HTTP header.

Certificate Rotation
type: Class
subclass of: Credential Rotation
subclass of: Restriction
  on property: regenerates
  some values from: Certificate
type: NamedIndividual
kb-reference: Reference-PasswordandKeyRotation-SSH
regenerates: Certificate
d3fend-id: D3-CERO
definition: Certificate rotation involves replacing digital certificates and their private keys to maintain cryptographic integrity and trust, mitigating key compromise risks and ensuring continuous secure communications.
kb-article: ## How it works Certificate rotation should be performed when: - Any certificate expires. - A new CA authority is substituted for the old, thus requiring a replacement root certificate. - New or modified constraints need to be imposed on one or more certificates. - A security breach has occurred. Considerations: - Managing certificate rotation across an enterprise can be complex. Automated solutions, sold by multiple vendors, should be considered to manage this complexity.

Certificate Trust Store
type: Class
subclass of: TrustStore
subclass of: Restriction
  on property: contains
  some values from: Certificate
type: NamedIndividual
contains: Certificate
definition: A certificate truststore is used to store public certificates used to authenticate clients by the server for an SSL connection.

Change Default Password
type: Class
subclass of: Strong Password Policy
subclass of: Restriction
  on property: hardens
  some values from: OT Controller
subclass of: Restriction
  on property: strengthens
  some values from: Password
subclass of: Restriction
  on property: strengthens
  some values from: UserAccount
type: NamedIndividual
hardens: OT Controller
kb-reference: Reference-CPGChecklist
kb-reference: Reference-GuidetoOTSecurity
kb-reference: Reference-MITREATTACKPasswordPolicies
strengthens: Password
strengthens: UserAccount
d3fend-id: D3-CFP
definition: Changing the default password means replacing the factory-set credentials with a strong, unique password before the device is deployed, preventing unauthorized access.
kb-article: ## How it works Change the default password as soon as a new device is received. The default credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means. ## Considerations * These should be changed before a device is brought online so that an adversary cannot take advantage of these default credentials. * Strong and complex passwords are preferred if the technology allows.

Chatroom Client
type: Class
subclass of: Collaborative Software
definition: Client software used to describe conduct any form of synchronous conferencing, occasionally even asynchronous conferencing. The term can thus mean any technology ranging from real-time online chat and online interaction with strangers (e.g., online forums) to fully immersive graphical social environments.
alternative label: Chat Room Client

Child Process
type: Class
subclass of: Process
definition: A child process in computing is a process created by another process (the parent process). This technique pertains to multitasking operating systems, and is sometimes called a subprocess or traditionally a subtask. There are two major procedures for creating a child process: the fork system call (preferred in Unix-like systems and the POSIX standard) and the spawn (preferred in the modern (NT) kernel of Microsoft Windows, as well as in some historical operating systems).

Classification
type: Class
subclass of: Supervised Learning
type: NamedIndividual
d3fend-id: D3A-CLA
kb-article: ## How it works Classification recognizes specific entities within the dataset and attempts to draw some conclusions on how those entities should be labeled or defined. Common classification algorithms are linear classifiers, support vector machines (SVM), decision trees, k-nearest neighbor, and random forest, which are described in more detail below. ## Considerations: There are many different types of classification algorithms for modeling classification predictive modeling problems. There is no single theory on how to map algorithms onto problem types; instead, it is generally recommended that a practitioner use controlled experiments and discover which algorithm and algorithm configuration results in the best performance for a given classification task. ## Key Test Considerations - **Machine Learning**: - **Verify the dataset quality**: Check the data to make sure it is free of errors. Quantify the degree of missing values, outliers, and noise in the data collection. If the data quality is low, it may be difficult or impossible to create models and systems with the desired performance. - **Verify development datasets are representative** of expected operational environment and data collection means. Compare distributions of dataset features and labels with exploratory data analysis and assess the difference in tests on training data and tests on evaluation data (where the evaluation data must be drawn from a representative dataset.) - **Use software libraries**: and tools built for ML where possible, so that the underlying code is verified by prior use.** - **Diagnose model errors with domain SMEs**: Have problem domain SMEs investigate model errors for conditions for which the model may underperform and suggest refinements. - **Classification**: - **Use Standard Classification Performance Measures**: Not all of the following may be necessary, but should be considered for both verification (developmental test) and operational test stages use: - **Accuracy**: The…
definition: Classification uses an algorithm to accurately assign test data into specific categories.

Classifying
type: Class
subclass of: Analytical Purpose

Client-server Payload Profiling
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
type: NamedIndividual
analyzes: Network Traffic
kb-reference: Reference-MethodAndSystemForDetectingMaliciousPayloads VectraNetworksInc
d3fend-id: D3-CSPP
kb-article: ## How it works Profiling request and response payloads across multiple clients to a single server to develop a baseline of their characteristics. May take into account request/response sizes, entropy, frequency, and rhythm. Finally, identify outliers as they may indicate a malicious payload delivery and subsequent server exploitation. ## Considerations * Collecting metrics to establish a profile can be challenging since user behavior can change easily. * Employees may work different hours or inconsistent schedules which will cause false positives. * Collection of network activity to generate metrics is a computationally intensive process. * Users may log into different workstations which may cause false positives.
definition: Comparing client-server request and response payloads to a baseline profile to identify outliers.

Client Application
type: Class
subclass of: Application
type: NamedIndividual
definition: A client application is software that accesses a service made available by a server. The server is often (but not always) on another computer system, in which case the client accesses the service by way of a network. The term applies to the role that programs or devices play in the client-server model

Client Computer
type: Class
subclass of: Host
type: NamedIndividual
definition: A client computer is a host that accesses a service made available by a server. The server is often (but not always) on another computer system, in which case the client accesses the service by way of a network.

Clipboard
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: The clipboard is a buffer that some operating systems provide for short-term storage and transfer within and between application programs. The clipboard is usually temporary and unnamed, and its contents reside in the computer's RAM. The clipboard is sometimes called the paste buffer. Windows, Linux and macOS support a single clipboard transaction. Each cut or copy overwrites the previous contents. Normally, paste operations copy the contents, leaving the contents available in the clipboard for further pasting.

Cloud-based Database Application
type: Class
subclass of: Database Service Application
subclass of: Restriction
  on property: provider
  some values from: Cloud Service Provider
type: NamedIndividual
provider: Cloud Service Provider
synonym: Serverless Database Application
definition: A database application where the underlying infrastructure is managed by a third-party cloud provider. Examples include DynamoDB, Firestore, and CosmosDB.

Cloud Configuration
type: Class
subclass of: Configuration Resource
type: NamedIndividual
alternative label: Cloud Configuration Information
definition: Information used to configure the services, parameters, and initial settings for a virtual server instance running in a cloud service.

Cloud Configuration Modification Event
type: Class
subclass of: Configuration Modification Event
subclass of: Restriction
  on property: has-participant
  some values from: Cloud Configuration
definition: An event that updates cloud-hosted resource configurations such as IAM policies, virtual network constructs, storage settings, or managed-service parameters; impacting resource provisioning, access control, functionality, or compliance.

Cloud Instance Metadata
type: Class
subclass of: Cloud Configuration
type: NamedIndividual
definition: Cloud instance metadata is configuration information on the instance and users of the instance. This includes such information as security groups, public ip addresses, and private addresses, public keys configured, and event rotating security keys. User data can contain initialization scripts, variables, passwords, and more.

Cloud Service Authentication
type: Class
subclass of: WebAuthentication
type: NamedIndividual
definition: A request-response comprising a user credential presentation to a system and a verification response where the verifying party is a cloud service.

Cloud Service Authorization
type: Class
subclass of: Authorization
type: NamedIndividual
definition: Cloud authorization is the function of specifying access rights to cloud resources.

Cloud Service Provider
type: Class
subclass of: Service Provider
type: NamedIndividual
definition: A cloud service provider delivers scalable and distributed computing resources over a network, enabling clients to access infrastructure, platforms, and applications remotely.

Cloud Service Sensor
type: Class
subclass of: Cyber Sensor
subclass of: Restriction
  on property: monitors
  some values from: Cloud Service Authentication
subclass of: Restriction
  on property: monitors
  some values from: Cloud Service Authorization
type: NamedIndividual
monitors: Cloud Service Authentication
monitors: Cloud Service Authorization
definition: Senses data from cloud service platforms. Including data from cloud service authentications, authorizations, and other activities.

Cloud Storage
type: Class
subclass of: Secondary Storage
type: NamedIndividual
definition: Cloud storage is storage held within a computing cloud.

Cloud User Account
type: Class
subclass of: UserAccount
type: NamedIndividual
definition: A user account on a given host is a local user account for a given cloud and specified resources within that cloud.

Cluster Analysis
type: Class
subclass of: UnsupervisedLearning
type: NamedIndividual
d3fend-id: D3A-CA
definition: Cluster analysis or clustering is the task of grouping a set of objects in such a way that objects in the same group (called a cluster) are more similar (in some sense) to each other than to those in other groups (clusters).
kb-article: ## References Cluster analysis. (n.d.). Wikipedia. [Link](https://en.wikipedia.org/wiki/Cluster_analysis)

Clustering
type: Class
subclass of: Summarizing

Code Analyzer
type: Class
subclass of: Developer Application
type: NamedIndividual
alternative label: Program Analysis Tool
definition: Code analyzers automatically analyze the composition or behavior of computer programs regarding a property such as correctness, robustness, security, and safety. Program analysis can be performed without executing the program (static program analysis), during runtime (dynamic program analysis) or in a combination of both.

Code Repository
type: Class
subclass of: Database
type: NamedIndividual
alternative label: Repository
alternative label: Version Control Repository
definition: A code repository is a form of database where code, typically source code, is stored and managed. In revision control systems, a repository is a data structure that stores metadata for a set of files or directory structure. Depending on whether the version control system in use is distributed like (Git or Mercurial) or centralized like (Subversion, CVS, or Perforce), the whole set of information in the repository may be duplicated on every user's system or may be maintained on a single server.

Codec Application
type: Class
subclass of: UserApplication
subclass of: Restriction
  on property: contains
  some values from: Codec Library
type: NamedIndividual
contains: Codec Library
definition: An application that encodes and decodes digital data.

Codec Library
type: Class
subclass of: Software Library
type: NamedIndividual
definition: A software component that encodes or decodes a data stream of signal.

Coefficient of Variation
type: Class
subclass of: Variability
type: NamedIndividual
d3fend-id: D3A-COV
synonym: RSD
synonym: Relative Standard Deviation
definition: The coefficient of variation (CV), also known as relative standard deviation (RSD), is a standardized measure of dispersion of a probability distribution or frequency distribution. The coefficient of variation (CV) is defined as the ratio of the standard deviation to the mean .
kb-article: ## References Wikipedia. (n.d.). Coefficient of variation. [Link](https://en.wikipedia.org/wiki/Coefficient_of_variation)

Collaborative Software
type: Class
subclass of: UserApplication
definition: Collaborative software or groupware is application software designed to help people working on a common task to attain their goals. One of the earliest definitions of groupware is "intentional group processes plus software to support them". Collaborative software is a broad concept that overlaps considerably with computer-supported cooperative work (CSCW). According to Carstensen and Schmidt (1999) groupware is part of CSCW. The authors claim that CSCW, and thereby groupware, addresses "how collaborative activities and their coordination can be supported by means of computer systems."

Collection Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Collection
type: NamedIndividual
enables: Collection

Command
type: Class
subclass of: Digital Information
type: NamedIndividual
definition: In computing, a command is a directive to a computer program acting as an interpreter of some kind, in order to perform a specific task. Most commonly a command is either a directive to some kind of command-line interface, such as a shell, or an event in a graphical user interface triggered by the user selecting an option in a menu.

Command and Control Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Command And Control
type: NamedIndividual
enables: Command And Control

Command History Log
type: Class
subclass of: Event Log
type: NamedIndividual
definition: A log of commands run in an operating system shell.

Command History Log File
type: Class
subclass of: Log File
subclass of: Restriction
  on property: contains
  some values from: Command History Log
type: NamedIndividual
contains: Command History Log
definition: A command history log file is a file containing a command history, which the history of commands run in an operating system shell.

Command Line Interface
type: Class
subclass of: UserInterface
definition: A command-line interface or command language interpreter (CLI), also known as command-line user interface, console user interface, and character user interface (CUI), is a means of interacting with a computer program where the user (or client) issues commands to the program in the form of successive lines of text (command lines). Command-line interfaces to computer operating systems are less widely used by casual computer users, who favor graphical user interfaces. Programs with command-line interfaces are generally easier to automate via scripting.
alternative label: CLI
alternative label: CUI
alternative label: Command-line Interface

Common Attack Pattern
type: Class
subclass of: CAPEC Thing
definition: A common attack pattern that is in the CAPEC knowledge base.

Compiler
type: Class
subclass of: Build Tool
subclass of: Restriction
  on property: reads
  some values from: Compiler Configuration File
type: NamedIndividual
reads: Compiler Configuration File
definition: In computing, a compiler is a computer program that translates computer code written in one programming language (the source language) into another language (the target language). The name "compiler" is primarily used for programs that translate source code from a high-level programming language to a lower level language (e.g., assembly language, object code, or machine code) to create an executable program.

Compiler Configuration File
type: Class
subclass of: Application Configuration File
type: NamedIndividual
definition: A file containing Information used to configure the parameters and initial settings for a compiler.

Compute Device Event
type: Class
subclass of: Hardware Device Event
subclass of: Restriction
  on property: has-participant
  some values from: Processor
definition: An event capturing the operation, state, or performance of computational hardware, such as CPUs, GPUs, or accelerators. These events reflect processing capacity changes, utilization anomalies, or device health.

Computer Network Node
type: Class
subclass of: Computer Platform
subclass of: Network Node
definition: A network node running on a computer platform.

Computer Platform
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Firmware
subclass of: Restriction
  on property: contains
  some values from: Hardware Device
subclass of: Restriction
  on property: contains
  some values from: Operating System
type: NamedIndividual
contains: Firmware
contains: Hardware Device
contains: Operating System
definition: Platform includes the hardware and OS. The term computing platform can refer to different abstraction levels, including a certain hardware architecture, an operating system (OS), and runtime libraries. In total it can be said to be the stage on which computer programs can run.
synonym: Computing Platform

Computing Image
type: Class
subclass of: Digital Information Bearer
definition: A computing image captures the full state or contents of a computing entity, such as a process or volume.

Computing Server
type: Class
subclass of: Server
definition: A compute server is a system specifically designed to undertake large amounts of computation, usually but not necessarily in a client/server environment.

Computing Snapshot
type: Class
subclass of: Digital Information Bearer
definition: In computer systems, a snapshot is the state of a system at a particular point in time.
alternative label: Snapshot

Condition
type: Class
subclass of: D3FEND Core
definition: An assumption on which rests the validity or effect of something else.
comment: Less common usage versus state, meant to superclass precondition, postcondition, and effect.

Configuration Database
type: Class
subclass of: Configuration Resource
subclass of: Restriction
  on property: contains
  some values from: Configuration Database Record
type: NamedIndividual
contains: Configuration Database Record

Configuration Database Record
type: Class
subclass of: Configuration Resource
subclass of: Database Record
type: NamedIndividual
definition: A Configuration Database Record defines settings, parameters, or preferences for applications, systems, or devices.
synonym: Configuration Record

Configuration Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Configuration Resource
definition: A discrete event that creates, applies, modifies, or deletes configuration resources to determine or alter the function of a system, device, application, or service.

Configuration File
type: Class
subclass of: File
definition: A file containing Information used to configure the parameters and initial settings for some computer programs. They are used for user applications, server processes and operating system settings.
alternative label: Settings File

Configuration Inventory
type: Class
subclass of: Asset Inventory
subclass of: Restriction
  on property: inventories
  some values from: Configuration Resource
type: NamedIndividual
inventories: Configuration Resource
kb-reference: Reference-Web-BasedEnterpriseManagement
kb-reference: Reference-Windows-Management-Infrastructure
kb-reference: Reference-Windows-Management-Instrumentation
d3fend-id: D3-CI
kb-article: ## How it works The organization retrieves configuration information through means of SNMP (MIB records), WBEM (CIM records), other protocols, or custom scripts and captures that information in a repository, typically known as a Configuration Management Database (CMDB)."
definition: Configuration inventory identifies and records the configuration of software and hardware and their components throughout the organization.

Configuration Management Database
type: Class
subclass of: Configuration Database
definition: A database used to store configuration records throughout their lifecycle. The Configuration Management System (CMS) maintains one or more CMDBs, and each CMDB stores attributes of configuration items (CIs), and relationships with other CIs.

Configuration Modification Event
type: Class
subclass of: Configuration Event
definition: An event that changes the persisted state of configuration resources by adding, updating, or removing parameters, impacting the target component's behavior.

Configuration Resource
type: Class
subclass of: Resource
type: NamedIndividual
definition: A resource used to configure a system including software and hardware.

Connect Socket
type: Class
subclass of: System Call
subclass of: Restriction
  on property: connects
  some values from: Pipe
type: NamedIndividual
connects: Pipe
definition: The connect socket system call connects the socket to a target address.

Connected Honeynet
type: Class
subclass of: Decoy Environment
subclass of: Restriction
  on property: spoofs
  some values from: Local Area Network
type: NamedIndividual
kb-reference: Reference-ModificationOfAServerToMimicADeceptionMechanism AcalvioTechnologiesInc
spoofs: Local Area Network
d3fend-id: D3-CHN
kb-article: ## How it works Decoy honeypots are deployed within the enterprise environment that emulate certain services or portions of an OS to attract attackers. ## Considerations A connected honeynet provides a tradeoff between emulating certain functionality but not being as sophisticated as an integrated honeynet. The connected honeynet may not provide enough functionality to detect new attack patterns or zero day exploits but could provide enough functionality for specific known vulnerabilities.
definition: A decoy service, system, or environment, that is connected to the enterprise network, and simulates or emulates certain functionality to the network, without exposing full access to a production system.

Connection Attempt Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Intranet Network Traffic
type: NamedIndividual
analyzes: Intranet Network Traffic
kb-reference: Reference-DetectingNetworkReconnaissanceByTrackingIntranetDark-netCommunications VECTRANETWORKSInc
d3fend-id: D3-CAA
kb-article: ## How it works Connection Attempt Analysis in multiple ways. ### Monitoring traffic to unallocated IP space One approach looks for failed connection attempts against unallocated IP space. First, network traffic is captured to map out the network to identify network assets as well as unallocated IP space. The map is then used to determine if connection attempts are being made to the unallocated IP space. ### Monitoring for sequentially transmitted traffic Another approach passively inspects network traffic with application protocol analyzers observing network activity characteristics such as volume of packets sent/ received, TCP session attributes, and connection information between hosts (start time, source/destination host, services, etc.). Then using pattern matching to identify traffic which appears to be probing for network hosts. ## Considerations * Implementations that rely on analysis of unallocated IP address space increase in their complexity with network size and decentralized network infrastructure. * Inventory of unallocated IP space should should be continuously updated to mitigate the risk of false positives. * IPv6 also introduces challenges including IPv6 traffic bypassing IPv4 specific protection systems (ex. firewalls and IDS) and complexity in managing both IPv6 and IPv4 addresses.
synonym: Network Scan Detection
definition: Analyzing failed connections in a network to detect unauthorized activity.

Console Output Function
type: Class
subclass of: Subroutine
definition: Outputs characters to a computer console.

Container Build Tool
type: Class
subclass of: Software Packaging Tool
definition: A software build tool that creates a container (e.g., Docker container) for deployment.

Container Image
type: Class
subclass of: Computing Image
subclass of: Software Package
type: NamedIndividual
definition: A container is a standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another. A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries and settings. Container images become containers at runtime and in the case of Docker containers - images become containers when they run on Docker Engine. Available for both Linux and Windows-based applications, containerized software will always run the same, regardless of the infrastructure. Containers isolate software from its environment and ensure that it works uniformly despite differences for instance between development and staging.

Container Image Analysis
type: Class
subclass of: Asset Vulnerability Enumeration
subclass of: Restriction
  on property: analyzes
  some values from: Container Image
type: NamedIndividual
analyzes: Container Image
kb-reference: Reference-ContainerImageAnalysis
d3fend-id: D3-CIA
definition: Analyzing a Container Image with respect to a set of policies.
synonym: Container Image Scanning
kb-article: ## How it works Container images are standalone collections of the executable code and content that are used to populate a container environment. They are usually created by either building a container from scratch or by building on top of an existing image pulled from a repository. Throughout the container build workflow, images should be scanned to identify: - outdated libraries, - known vulnerabilities, - or misconfigurations, such as insecure ports or permissions. Scanning should also provide the flexibility to disregard false positives for vulnerability detection where knowledgeable cybersecurity professionals have deemed alerts to be inaccurate. One approach to implementing image scanning is to use an admission controller to block deployments if the image does not comply with the organization's security policies. An admission controller is a Container Orchestration feature that can intercept and process requests to the Container Orchestration API prior to persistence of the object, but after the request is authenticated and authorized. A webhook can be implemented to scan any image before it is deployed in the orchestrator. This admission controller ## Considerations * Image scanning is key to ensuring deployed containers are secure. * Using trusted repositories to build containers is a critical part of the container build workflow. * This technique does not necessarly prevent the build process to add insecure or unsecured files to the Image.

Container Orchestration Software
type: Class
subclass of: Service Application
type: NamedIndividual
definition: A d3f:Software which manages and coordinates running one or more d3f:ContainerProcess.

Container Process
type: Class
subclass of: Application Process
definition: A running instance of a container image.

Container Runtime
type: Class
subclass of: Service Application
subclass of: Restriction
  on property: runs
  some values from: Container Image
type: NamedIndividual
runs: Container Image
definition: A software layer between a container process and a kernel which often mediates the invocation of a system call.

Content Excision
type: Class
subclass of: Content Modification
type: NamedIndividual
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
d3fend-id: D3-CNE
definition: Removing specific, potentially malicious, parts of content
kb-article: ## How it works If malicious or unecessary elements is discovered within the content, or if a specific embedded portion does not comply with policy, it may be removed to ensure safety.

Content Filtering
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Isolate
subclass of: Restriction
  on property: enforces
  some values from: Content Policy
subclass of: Restriction
  on property: filters
  some values from: File
type: NamedIndividual
enables: Isolate
enforces: Content Policy
filters: File
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
d3fend-id: D3-CF
definition: Content Filtering techniques aid in the process of analyzing an input file for malicious or erroneous content and outputing a sanitized version.

Content Format Conversion
type: Class
subclass of: Content Modification
type: NamedIndividual
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
d3fend-id: D3-CFC
kb-article: ## How it works This technique may enhance security by transforming files into safer or normalized formats.
definition: Content format conversion is mechanical transformation from one format to another which may be normalization or specifically flattening.

Content Modification
type: Class
subclass of: Content Filtering
subclass of: Restriction
  on property: filters
  some values from: Digital Media
subclass of: Restriction
  on property: filters
  some values from: File Content Block
subclass of: Restriction
  on property: filters
  some values from: File Metadata
subclass of: Restriction
  on property: modifies
  some values from: File
type: NamedIndividual
filters: Digital Media
filters: File Content Block
filters: File Metadata
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
modifies: File
d3fend-id: D3-CM
definition: Modify content that does not comply with policy.
kb-article: ## How it works When content is found to not comply with it's content policy, it may be transformed to a safer state by modifying it.

Content Policy
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A set of rules and guidelines that dictate the acceptable use, distribution, and management of digital content within a system or platform. It defines what content is allowed, restricted, or prohibited, ensuring compliance with legal, ethical, and organizational standards.

Content Quarantine
type: Class
subclass of: Content Filtering
subclass of: Restriction
  on property: quarantines
  some values from: Database Record
subclass of: Restriction
  on property: quarantines
  some values from: File
type: NamedIndividual
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
quarantines: Database Record
quarantines: File
d3fend-id: D3-CQ
definition: Transfer content that does not comply with policy to a quarantine zone.
kb-article: ## How it works Quarantining serves as a protective measure to isolate potentially harmful files or elements until they can be safely analyzed or processed.

Content Rebuild
type: Class
subclass of: Content Modification
type: NamedIndividual
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
d3fend-id: D3-CNR
definition: Rebuild the file according to the spec so any unreferenced components or objects are removed.
kb-article: ## How it works If inputted content is divided up into components for further scrutiny, the components may be combined back afterwards in a safer state.
synonym: Content Reconstruction

Content Substitution
type: Class
subclass of: Content Modification
type: NamedIndividual
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
d3fend-id: D3-CNS
kb-article: ## How it works If malicious or unecessary elements is discovered within the content, or if a specific embedded portion does not comply with policy, it may be replaced with alternatives to ensure safety.
definition: Modifies specific digital content information by replacing it with something else.

Content Validation
type: Class
subclass of: Content Filtering
type: NamedIndividual
kb-reference: Reference-FileSecurityUsingFileFormatValidation OPSWATInc
d3fend-id: D3-CV
definition: Verify and validate contents complies with policy
kb-article: ## How it works To ensure that content is safe, it's composition must be validated according to its content policy.

Control Catalog
type: Class
subclass of: External Control Thing
subclass of: Restriction
  on property: has-member
  some values from: External Control
subclass of: Restriction
  on property: version
  some values from: Datatype
    union of: integer
    union of: string
definition: A control catalog is a complete list of protective measures for systems, organizations, or individuals for subject domains (e.g., security and privacy.)

Control Correlation Identifier Catalog
type: Class
subclass of: Control Catalog
subclass of: Restriction
  on property: has-member
  some values from: CCI Control
definition: A control correlation identifier (CCI) catalog provides a catalog of CCIs for a given release date.

Convolutional Neural Network
type: Class
subclass of: Deep Neural Network Classification
type: NamedIndividual
d3fend-id: D3A-CNN
definition: A class of artificial neural network most commonly applied to analyze visual imagery.CNNs use a mathematical operation called convolution in place of general matrix multiplication in at least one of their layers.
kb-article: ## References Wikipedia. (n.d.). Convolutional neural network. [Link](https://en.wikipedia.org/wiki/Convolutional_neural_network)

Copy Memory Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: copies
  some values from: Memory Block
type: NamedIndividual
copies: Memory Block
definition: Copies a memory block from one location to another.

Copy Token
type: Class
subclass of: System Call
subclass of: Restriction
  on property: copies
  some values from: Access Token
type: NamedIndividual
type: System Call
copies: Access Token

Correlation
type: Class
subclass of: Descriptive Statistics
type: NamedIndividual
d3fend-id: D3A-COR
kb-article: Wolfram MathWorld. (n.d.). Correlation. [Link](https://mathworld.wolfram.com/Correlation.html)
definition: Correlation is the degree to which two or more quantities are linearly associated.

Correlation Clustering
type: Class
subclass of: High-dimension Clustering
type: NamedIndividual
d3fend-id: D3A-CC
definition: Correlation clustering provides a method for clustering a set of objects into the optimum number of clusters without specifying that number in advance.
kb-article: ## References Wikipedia. (n.d.). Correlation clustering. [Link](https://en.wikipedia.org/wiki/Correlation_clustering)

Cramer's V
type: Class
subclass of: Correlation
type: NamedIndividual
d3fend-id: D3A-CV
kb-article: ## References Wikipedia. (n.d.). Cramér's V. [Link](https://en.wikipedia.org/wiki/Cram%C3%A9r%27s_V)
synonym: Cramer's Phi
definition: Cramér's V (sometimes referred to as Cramér's phi and denoted as φc) is a measure of association between two nominal variables, giving a value between 0 and +1 (inclusive) and is based on Pearson's chi-squared statistic.

Create File
type: Class
subclass of: System Call
subclass of: Restriction
  on property: creates
  some values from: File
type: NamedIndividual
creates: File
definition: System call to create a new file on a file system. Some operating systems implement this functionality as part of their d3f:OpenFile system call.

Create Process
type: Class
subclass of: System Call
subclass of: Restriction
  on property: executes
  some values from: Process
type: NamedIndividual
executes: Process
definition: Executes a process.
alternative label: Execute Process
definition: Creates a process.
alternative label: Process Spawn
alternative label: Spawn Process
definition: A process spawn refers to a function that loads and executes a new child process.The current process may wait for the child to terminate or may continue to execute asynchronously. Creating a new subprocess requires enough memory in which both the child process and the current program can execute. There is a family of spawn functions in DOS, inherited by Microsoft Windows. There is also a different family of spawn functions in an optional extension of the POSIX standards. Fork-exec is another technique combining two Unix system calls, which can effect a process spawn.

Create Socket
type: Class
subclass of: System Call
subclass of: Restriction
  on property: creates
  some values from: Pipe
type: NamedIndividual
creates: Pipe
definition: A create socket system call creates an endpoint for communication and returns a file descriptor that refers to that endpoint.

Create Thread
type: Class
subclass of: System Call
subclass of: Restriction
  on property: creates
  some values from: Thread
type: NamedIndividual
creates: Thread
definition: Threads are an execution model that exists independently from a language, as well as a parallel execution model. They enable a program to control multiple different flows of work that overlap in time.

Credential
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: authenticates
  some values from: UserAccount
type: NamedIndividual
authenticates: UserAccount
definition: A credential is a physical/tangible object, a piece of knowledge, or a facet of a person's physical being that enables an individual access to a given physical facility or computer-based information system. Typically, credentials can be something a person knows (such as a number or PIN), something they have (such as an access badge), something they are (such as a biometric feature), something they do (measurable behavioral patterns) or some combination of these items. This is known as multi-factor authentication. The typical credential is an access card or key-fob, and newer software can also turn users' smartphones into access devices.

Credential Access Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: accesses
  some values from: Credential
subclass of: Restriction
  on property: enables
  some values from: Credential Access
subclass of: Restriction
  on property: may-access
  some values from: Password File
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
type: NamedIndividual
accesses: Credential
enables: Credential Access
may-access: Password File
may-invoke: Create Process

Credential Compromise Scope Analysis
type: Class
subclass of: UserBehaviorAnalysis
subclass of: Restriction
  on property: analyzes
  some values from: Credential
type: NamedIndividual
analyzes: Credential
kb-reference: Reference-AllLoginsSinceLastBoot MITRE
kb-reference: Reference-SystemsAndMethodsForDetectingCredentialTheft SymantecCorp
d3fend-id: D3-CCSA
kb-article: ## How it works #### Memory Credentials may be stored in memory for a variety of reasons; on Windows, they may be stored in lsass.exe. Once a credential dumper like mimikatz runs and dumps the memory of lsass.exe, the credentials of every account logged on since boot are potentially compromised. When such an event occurs, this analytic will give the forensic context to identify compromised users. Those users could potentially be used in later events for additional logons. #### Hard disk Operating System may cache a certain number of credentials onto the hard disk to use as a source of truth if it cannot contact the credential server. In many versions of Microsoft Windows, the 10 most recent are cached by default; this setting can be changed in the Microsoft Management Console's Local Security Policy: ```Computer Configuration -> Windows Settings -> Local Policy -> Security Options -> Interactive Logon: Number of previous logons to cache -> 0``` Here we are not concerned with the alteration of the credentials but the fact that they might be read. If the attacker has physical access to the machine they are unlikely to be stopped from reading files on the filesystem. "In the event that the domain controller is unavailable Windows will check the last password hashes that has been cached in order to authenticate the user with the system. These password hashes are cached in the following registry setting: HKEY_LOCAL_MACHINE\SECURITY\Cache Mimikatz can retrieve these hashes if the following command is executed: lsadump::cache" [1] The Registry Hive, HKEY_LOCAL_MACHINE\SAM, which is stored in the supporting files %systemroot%\System32\Config\{Sam,sam.log,sam.sav}, contains the SAM file. DC: This is stored in %systemroot%\ntds\ntds.dit. (https://www.ultimatewindowssecurity.com/blog/default.aspx?d=10/2017) Sometimes memory, which contains credentials, could get on the hard disk. Like with hiberfil.sys in Windows. Equivalent on Linux In Linux, an attacker could read the /etc/s…
definition: Determining which credentials may have been compromised by analyzing the user logon history of a particular system.

Credential Eviction
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Evict
type: NamedIndividual
enables: Evict
kb-reference: Reference-AccountMonitoring ForescoutTechnologies
d3fend-id: D3-CE
definition: Credential Eviction techniques disable or remove compromised credentials from a computer network.

Credential Hardening
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Harden
subclass of: Restriction
  on property: hardens
  some values from: Credential
type: NamedIndividual
enables: Harden
hardens: Credential
d3fend-id: D3-CH
definition: Credential Hardening techniques modify system or network properties in order to protect system or network/domain credentials.

Credential Management System
type: Class
subclass of: Service Application
type: NamedIndividual
definition: Credential Management, also referred to as a Credential Management System (CMS), is an established form of software that is used for issuing and managing credentials as part of public key infrastructure (PKI).

Credential Revocation
type: Class
subclass of: Credential Eviction
subclass of: Restriction
  on property: deletes
  some values from: Credential
type: NamedIndividual
deletes: Credential
kb-reference: Reference-RevokingaPreviouslyIssuedVerifiableCredential-Microsoft
d3fend-id: D3-CR
definition: Deleting a set of credentials permanently to prevent them from being used to authenticate.
kb-article: ## How it works Management servers with enterprise policies for account management provide the ability remove permissions, accounts, or credentials. Compromised credentials should be revoked to prevent further malicious activity.

Credential Rotation
type: Class
subclass of: Credential Hardening
subclass of: Restriction
  on property: regenerates
  some values from: Credential
type: NamedIndividual
kb-reference: Reference-PasswordandKeyRotation-SSH
regenerates: Credential
d3fend-id: D3-CRO
definition: Credential rotation is a security procedure in which authentication credentials, such as passwords, API keys, or certificates, are regularly changed or replaced to minimize the risk of unauthorized access.
kb-article: ## How it works Credentials can be systematically changed at predetermined intervals or based on specific events. Credentials such as user passwords may be rotated manually, but it is increasingly common to use an automated system to manage rotation of enterprise passwords, certificates and keys. ## Considerations - Rotation of credentials must be managed carefully to avoid inadvertent service interruption - Management servers with enterprise policies for account management provide the ability to change or reset passwords for accounts. Some organizations rotate credentials periodically to limit the risk of stolen credentials. - When responding to an incident, severity of compromise should be considered to determine what credentials to what accounts should be regenerated - If proactively rotating credentials periodically, several factors should be considered to determine the frequency. Also introduces some risk including promoting the creation of weak passwords and poor storage practices for employees and presents challenges in proper tracking.

Credential Scrubbing
type: Class
subclass of: Source Code Hardening
subclass of: Restriction
  on property: hardens
  some values from: Subroutine
type: NamedIndividual
hardens: Subroutine
kb-reference: Reference-SecretsManagementCheatSheet-OWASP
d3fend-id: D3-CS
kb-article: ## How it Works Credential Scrubbing involves identifying and eliminating hard-coded credentials such as usernames, passwords, API keys, and tokens from source code repositories. These credentials should be managed securely using environment variables, secret management tools, or secure vaults where they can be safely accessed when needed. ## Considerations * Developers should conduct regular audits of source code to ensure credentials are not hard-coded. * Exposed credentials found in version control history must be disabled and replaced promptly. * Adopt role-based access controls and credential rotation policies to minimize security risks.
definition: The systematic removal of hard-coded credentials from source code to prevent accidental exposure and unauthorized access.

Credential Transmission Scoping
type: Class
subclass of: Access Mediation
subclass of: Restriction
  on property: isolates
  some values from: Credential
type: NamedIndividual
isolates: Credential
d3fend-id: D3-CTS
definition: Limiting the transmission of a credential to a scoped set of relying parties.
synonym: Phishing Resistant Authentication

Cryptographic Key
type: Class
subclass of: Digital Information
type: NamedIndividual
definition: In cryptography, a key is a piece of information (a parameter) that determines the functional output of a cryptographic algorithm. For encryption algorithms, a key specifies the transformation of plaintext into ciphertext, and vice versa for decryption algorithms. Keys also specify transformations in other cryptographic algorithms, such as digital signature schemes and message authentication codes.

Custom Archive File
type: Class
subclass of: Archive File
type: NamedIndividual
definition: A custom archive file is an archive file conforming to a custom format; that is, an archive file that does not conform to a common standard.

Cyber Action
type: Class
subclass of: Action

Cyber Sensor
type: Class
subclass of: Sensor
definition: A cyber sensor collects and monitors data related to cyber activities, events, or environments.

Cyber Technique
type: Class
subclass of: Technique
subclass of: Restriction
  on property: implemented-by
  some values from: Procedure

CycleGAN
type: Class
subclass of: Image-to-Image Translation GAN
type: NamedIndividual
d3fend-id: D3A-CYC
definition: The Cycle Generative Adversarial Network (CycleGAN) is an approach to training a deep convolutional neural network for image-to-image translation tasks by mapping between input and output images using unpaired dataset.
kb-article: ## References Esri. (n.d.). How CycleGAN Works. [Link](https://developers.arcgis.com/python/guide/how-cyclegan-works/)

D3FEND Core
type: Class
type: NamedIndividual

D3FEND KB Thing
type: Class

DBSCAN
type: Class
subclass of: Density-based Clustering
type: NamedIndividual
d3fend-id: D3A-DBS
kb-article: ## References Analytics Vidhya. (2020, September 15). How DBSCAN Clustering Works: A Comprehensive Guide with Implementations in Python. [Link](https://www.analyticsvidhya.com/blog/2020/09/how-dbscan-clustering-works/#:~:text=DBSCAN%20is%20a%20density%2Dbased,points%20into%20a%20single%20cluster.)
definition: A density-based clustering algorithm that works on the assumption that clusters are dense regions in space separated by regions of lower density.

DHCP Ack Event
type: Class
subclass of: DHCP Event
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Request Event
definition: An event where a DHCP server sends an ACK message to acknowledge a client's REQUEST, confirming the allocation of an IP address and associated network settings.
alternative label: DHCPACK

DHCP Discover Event
type: Class
subclass of: DHCP Event
definition: An event where a DHCP client broadcasts a DISCOVER message to identify available DHCP servers capable of providing IP configuration.
alternative label: DHCPDISCOVER

DHCP Event
type: Class
subclass of: Application Layer Event
subclass of: UDPEvent
subclass of: Restriction
  on property: has-participant
  some values from: DHCP Network Traffic
definition: An event involving the Dynamic Host Configuration Protocol (DHCP), a UDP-based protocol used to dynamically assign IP addresses and configure network parameters, enabling devices to communicate efficiently on a network.

DHCP Inform Event
type: Class
subclass of: DHCP Event
definition: An event where a DHCP client sends an INFORM message to request configuration parameters, such as DNS or gateway information, without requiring IP address assignment.
alternative label: DHCPINFORM

DHCP Lease Expire Event
type: Class
subclass of: DHCP Event
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Ack Event
definition: An event indicating that a DHCP lease has expired, rendering the previously assigned IP address available for reassignment to other devices.
alternative label: DHCPLEASEEXPIRE

DHCP Nak Event
type: Class
subclass of: DHCP Event
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Request Event
definition: An event where a DHCP server sends a NAK message to reject a client's REQUEST, indicating that the requested configuration cannot be granted.
alternative label: DHCPNAK

DHCP Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: DHCP Network Traffic is network traffic related to the DHCP protocol, used by network nodes to negotiate and configure either IPv4 or IPv6 addresses.

DHCP Offer Event
type: Class
subclass of: DHCP Event
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Discover Event
definition: An event where a DHCP server sends an OFFER message to a client in response to a DISCOVER request, proposing an IP address and associated configuration parameters.
alternative label: DHCPOFFER

DHCP Release Event
type: Class
subclass of: DHCP Event
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Ack Event
definition: An event where a DHCP client sends a RELEASE message to relinquish its assigned IP address and cancel any remaining lease duration.
alternative label: DHCPRELEASE

DHCP Request Event
type: Class
subclass of: DHCP Event
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Offer Event
definition: An event where a DHCP client sends a REQUEST message to confirm or renew its desired IP configuration with a specific DHCP server.
alternative label: DHCPREQUEST

DHCP Server
type: Class
subclass of: Server
subclass of: Restriction
  on property: contains
  some values from: DHCP Service Application
subclass of: Restriction
  on property: manages
  some values from: DHCP Service
type: NamedIndividual
contains: DHCP Service Application
manages: DHCP Service
definition: A Dynamic Host Configuration Protocol (DHCP) server is a type of server that assigns IP addresses to computers. DHCP servers are used to assign IP addresses to computers and other devices automatically. The DHCP server is responsible for assigning the unique IP address to each device.

DHCP Service
type: Class
subclass of: Network Service
subclass of: Restriction
  on property: may-produce
  some values from: DHCP Network Traffic
type: NamedIndividual
may-produce: DHCP Network Traffic
definition: A DHCP service assigns IP address and modifies network configurations.

DHCP Service Application
type: Class
subclass of: Service Application
subclass of: Restriction
  on property: instructs
  some values from: DHCP Service
type: NamedIndividual
instructs: DHCP Service
definition: An application that automates the assignment of IP addresses and other network configuration parameters to devices on a network

DNN-based Clustering
type: Class
subclass of: ANN-based Clustering
type: NamedIndividual
d3fend-id: D3A-DBC
kb-article: ## References OpenReview. (n.d.). Unsupervised Clustering using Pseudo Ensemble Models. [Link](https://openreview.net/pdf?id=B1eT9VMgOX)
definition: DNNs serve for clustering as mappings to better representations. The features of these representations can be drawn from different layers of the network or even from several layers.

DNS Allowlisting
type: Class
subclass of: Network Isolation
subclass of: Restriction
  on property: blocks
  some values from: Outbound Internet DNS Lookup Traffic
type: NamedIndividual
blocks: Outbound Internet DNS Lookup Traffic
kb-reference: Reference-DNSWhitelist-DNSWL-EmailAuthenticationMethodExtension
d3fend-id: D3-DNSAL
synonym: DNS Whitelisting
definition: Permitting only approved domains and their subdomains to be resolved.

DNS Cache Eviction
type: Class
subclass of: Object Eviction
subclass of: Restriction
  on property: deletes
  some values from: DNS Record
type: NamedIndividual
deletes: DNS Record
d3fend-id: D3-DNSCE
synonym: Flush DNS Cache
kb-article: # How it works Flushing the DNS Cache will clear the IP addresses of websites you have visited recently. This can help remediate DNS Cache Poisoning attacks, which is a type of cyber attack where corrupted DNS data is inserted into the cache, causing redirects to malicious websites. On windows, the DNS cache can be wiped by issuing the command `ipconfig /flushdns`.
definition: Flushing DNS to clear any IP addresses or other DNS records from the cache.

DNS Denylisting
type: Class
subclass of: Network Isolation
subclass of: Restriction
  on property: blocks
  some values from: DNS Network Traffic
type: NamedIndividual
blocks: DNS Network Traffic
kb-reference: Reference-UseDNSPolicyForApplyingFiltersOnDNSQueries
d3fend-id: D3-DNSDL
kb-article: ## How it works Rules are implemented that filter DNS queries using criteria such as: - Client subnet - Type of network protocol used in query - Fully qualified domain name (FQDN) of record in the query - DNS Server IP address that received the DNS request - Type of DNS record being queried - Time of day the query is received - Size of the response For example, a DNS policy can be created for blocking DNS queries for FQDNs that have been identified as unauthorized. ## Considerations - Implementation considerations for DNS filtering policies to avoid over-blocking or under-blocking domains. - Continuous maintenance of unauthorized domain lists is needed to keep up to date with possible site content changes. - File sharing or content delivery networks may require other filtering techniques that are more fine-grained (URL blocking). - Access to malicious websites or other network resources directly by IP instead of by DNS record, or after alteration of local DNS hosts file, may not result in DNS network traffic.
synonym: DNS Blacklisting
definition: Blocking DNS Network Traffic based on criteria such as IP address, domain name, or DNS query type.

DNS Event
type: Class
subclass of: Application Layer Event
subclass of: Class
  union of: TCP Event
  union of: UDPEvent
subclass of: Restriction
  on property: has-participant
  some values from: DNS Network Traffic
definition: An event involving the Domain Name System (DNS), which translates domain names to IP addresses and operates over UDP and TCP.

DNS Lookup
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A Domain Name System (DNS) lookup is a record returned from a DNS resolver after querying a DNS name server. Typically considered an A or AAAA record, where a domain name is resolved to an IPv4 or IPv6 address, respectively.

DNS Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: DNS network traffic is network traffic related to queries and responses involving the Domain Name System. DNS traffic can involve clients, servers such as relays or resolvers. This includes only network traffic conforming to standard DNS protocol; not custom protocols.

DNS Query Event
type: Class
subclass of: DNS Event
definition: An event where a DNS query is made to resolve a domain name.

DNS Record
type: Class
subclass of: Record
type: NamedIndividual
definition: A Domain Name System (DNS) record is a record of information returned to clients seeking to find computers, services, and other resources connected to the Internet or a private network. Record information is stored on a domain name server so it can respond to DNS queries from clients.There are a variety of record types, depending on the client's information needs. Common types include Start of Authority, IP addresses, SMTP mail exchangers, name servers, reverse DNS lookup pointers, etc.

DNS Response Event
type: Class
subclass of: DNS Event
subclass of: Restriction
  on property: preceded-by
  some values from: DNS Query Event
definition: An event where a DNS server responds to a query with resolution data.

DNS Server
type: Class
subclass of: Server
definition: A Domain Name System (DNS) name server is a kind of name server. Domain names are one of the two principal namespaces of the Internet. The most important function of DNS servers is the translation (resolution) of human-memorable domain names and hostnames into the corresponding numeric Internet Protocol (IP) addresses, the second principal name space of the Internet which is used to identify and locate computer systems and resources on the Internet. (en). More generally, a name server is a computer application that implements a network service for providing responses to queries against a directory service. It translates an often humanly meaningful, text-based identifier to a system-internal, often numeric identification or addressing component. This service is performed by the server in response to a service protocol request.

DNS Traffic Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Outbound Internet DNS Lookup Traffic
subclass of: Restriction
  on property: may-contain
  some values from: DNS Lookup
type: NamedIndividual
analyzes: Outbound Internet DNS Lookup Traffic
kb-reference: Reference-HeuristicBotnetDetection PaloAltoNetworksInc
kb-reference: Reference-MethodAndSystemForDetectingAlgorithm-generatedDomains VECTRANETWORKSInc
kb-reference: Reference-PredictingDomainGenerationAlgorithmsWithLongShort-TermMemoryNetworks
kb-reference: Reference-SinkholingBadNetworkDomainsByRegisteringTheBadNetworkDomainsOnTheInternet PaloAltoNetworksInc
may-contain: DNS Lookup
d3fend-id: D3-DNSTA
definition: Analysis of domain name metadata, including name and DNS records, to determine whether the domain is likely to resolve to an undesirable host.
kb-article: ## How it works This technique can be accomplished in a number of ways. * One example analytic determines whether or not a domain name was generated with an algorithm. Domain generation algorithms (DGAs) are sometimes used to create a domain name automatically that will resolve to C2 infrastructure, without directly coding the domains in question into the malicious code. * Another method analyzes information about domains that have been visited, including whether a domain name is longer than a common length, if a dynamic DNS domain was visited, if a fast-flux domain was visited, and if a recently created domain was visited. These factors are used to develop a score and if that score is over a certain threshold, an alert is generated. * Collected malware samples can be executed in a virtual environment to identify network domains that are connected to during execution. The network domains are then generated into signatures to identity bad domains for other hosts. This technique does not check for content hosted at the domain. ## Considerations * DNS produces a large amount of traffic which can be resource-intensive to analyze in real time. * If a server is compromised, for example, as part of a watering hole attack, but the DNS information pointing to that server is not altered, this technique would not catch such an incident.
synonym: Domain Name Analysis

Data Artifact Server
type: Class
subclass of: Artifact Server
definition: A data artifact server provides access services to content in a content repository. The content repository or content store is a database of digital content with an associated set of data management, search and access methods allowing application-independent access to the content, rather like a digital library, but with the ability to store and modify content in addition to searching and retrieving. The content repository acts as the storage engine for a larger application such as a content management system or a document management system, which adds a user interface on top of the repository's application programming interface.

Data Dependency
type: Class
subclass of: Dependency
type: NamedIndividual
synonym: Transactional Dependency
definition: A Data Dependency exists when a process, operation, or system requires specific data in order to execute correctly.

Data Exchange Mapping
type: Class
subclass of: System Mapping
subclass of: Restriction
  on property: maps
  some values from: Data Dependency
type: NamedIndividual
kb-reference: Reference-CatiaUAFPlugin
kb-reference: Reference-UnifiedArchitectureFrameworkUAF
maps: Data Dependency
d3fend-id: D3-DEM
synonym: Data Flow Mapping
definition: Data exchange mapping identifies and models the organization's intended design for the flows of the data types, formats, and volumes between systems at the application layer.
synonym: Information Exchange Mapping

Data Inventory
type: Class
subclass of: Asset Inventory
subclass of: Restriction
  on property: inventories
  some values from: Database
subclass of: Restriction
  on property: inventories
  some values from: Document File
type: NamedIndividual
inventories: Database
inventories: Document File
kb-reference: Reference-DataProcessingAndScanningSystemsForGeneratingAndPopulatingADataInventory
d3fend-id: D3-DI
synonym: Data Discovery
synonym: Data Inventorying
definition: Data inventorying identifies and records the schemas, formats, volumes, and locations of data stored and used on the organization's architecture.

Data Link Link
type: Class
subclass of: Logical Link
definition: A communication link between two network devices connected directly at the physical layer and on the same network segment; i.e., an OSI Layer 2 link.
synonym: Data Link Layer Link
synonym: Layer-2 Link
synonym: Link Layer Link

Database
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Database Record
type: NamedIndividual
contains: Database Record
definition: A database is an organized collection of data, generally stored and accessed electronically from a computer system. Where databases are more complex they are often developed using formal design and modeling techniques.

Database Application
type: Class
subclass of: Application
type: NamedIndividual
synonym: Database Management System (DBMS)
definition: A database application is a computer program whose primary purpose is retrieving information from a computerized database.

Database File
type: Class
subclass of: File
subclass of: Restriction
  on property: contains
  some values from: Database
type: NamedIndividual
contains: Database
definition: A file that stores data and metadata in an organized format, managed by a database management system.

Database Query
type: Class
subclass of: Command
subclass of: Restriction
  on property: queries
  some values from: Database
type: NamedIndividual
queries: Database
definition: A specific query expressed in SQL, SPARQL, or similar language against a database.

Database Query String Analysis
type: Class
subclass of: Process Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Database Query
type: NamedIndividual
analyzes: Database Query
kb-reference: Reference-SystemAndMethodForInternetSecurity CylanceInc
d3fend-id: D3-DQSA
definition: Analyzing database queries to detect [SQL Injection](https://capec.mitre.org/data/definitions/66.html).
kb-article: ## How it works Some implementations use software hooks to intercept function calls related to database query operations. Other implementations might intercept or collect network traffic. The database query string is then extracted and analyzed with various methods, for example: * Detecting specific administrative SQL commands * Anomalous sequences of commands when compared to a statistical baseline. * Anomalous commands for a given user role. ## Considerations Some capabilities sanitize queries before permitting them to be transmitted to the database. This incurs risks such altering data in an undesired way or breaking application functionality.

Database Record
type: Class
subclass of: Record
type: NamedIndividual
definition: A single, implicitly structured data item in a table in a database.

Database Server
type: Class
subclass of: Server
subclass of: Restriction
  on property: contains
  some values from: Database Application
type: NamedIndividual
contains: Database Application
definition: A database server is a server which uses a database application that provides database services to other computer programs or to computers, as defined by the client-server model. Database management systems (DBMSs) frequently provide database-server functionality, and some database management systems (such as MySQL) rely exclusively on the client-server model for database access (while others e.g. SQLite are meant for using as an embedded database). For clarification, a database server is simply a server that maintains services related to clients via database applications.
alternative label: Network Database Resource

Database Service
type: Class
subclass of: Service Application Process
subclass of: Restriction
  on property: executes
  some values from: Database Query
subclass of: Restriction
  on property: manages
  some values from: Database
type: NamedIndividual
executes: Database Query
manages: Database
definition: A database service interacts with a database, either retrieving data through queries or making modifications to its contents.

Database Service Application
type: Class
subclass of: Database Application
subclass of: Service Application
subclass of: Restriction
  on property: instructs
  some values from: Database Service
type: NamedIndividual
instructs: Database Service
definition: A software application that interacts with a database management system (DBMS) hosted as a separate, standalone service or server.

Datalog
type: Class
subclass of: Logic Programming
type: NamedIndividual
d3fend-id: D3A-DAT
kb-article: ## How it works Datalog generally uses a bottom-up rather than top-down evaluation model. This difference yields significantly different behavior and properties from Prolog. It is often used as a query language for deductive databases. Datalog has been applied to problems in data integration, networking, program analysis, and more. ## References 1. Datalog. (2023, April 20). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Datalog)
definition: Datalog is a declarative logic programming language that is a syntactically a subset of Prolog.

Dead Code Elimination
type: Class
subclass of: Application Hardening
type: NamedIndividual
kb-reference: Reference-DeadCodeElimination
d3fend-id: D3-DCE
kb-article: ## How it works Dead code is code that is considered unreachable by normal program execution. Dead code can be created by adding code under a condition that never evaluates to true. Dead code should be removed since this type of code can produce unexpected results, if accidentally or maliciously forced to execute. Dead code identification is typically performed by algorithms that implement program flows analysis looking for unreachable code. The dead code is eliminated by instructing compilers to remove the code through compiler flags, i.e., '-fdce' is used for Dead Code Elimination. ## Considerations Code can also be deemed unreachable for certain run-time conditions. Different deployed systems and environments may contain some code that is unreachable for the given environment. This technique does not consider run-time conditions for unreachable code.
definition: Removing unreachable or "dead code" from compiled source code.

Deceive
type: Class
subclass of: Defensive Tactic
type: NamedIndividual
type: Defensive Tactic
display-priority: 0
display-order: 3
definition: The deceive tactic is used to advertise, entice, and allow potential attackers access to an observed or controlled environment.

Decision Tree
type: Class
subclass of: Classification
type: NamedIndividual
d3fend-id: D3A-DT
kb-article: ## How it works A decision tree starts with a root node, which does not have any incoming branches. The outgoing branches from the root node then feed into the internal nodes, also known as decision nodes. Based on the available features, both node types conduct evaluations to form homogenous subsets, which are denoted by leaf nodes, or terminal nodes. The leaf nodes represent all the possible outcomes within the dataset. ## Considerations While the basic underlying model is that of a decision tree, the decision tree node criteria, and the method for identifying splits varies significantly depending on the learning algorithm selected (e.g., CART, ID3, C4.5, C5.0, CHAID, MARS.) Extensions like linear and logistic trees can add additional expressiveness as well. ## Key Test Considerations - **Machine Learning**: - **Verify the dataset quality**: Check the data to make sure it is free of errors. Quantify the degree of missing values, outliers, and noise in the data collection. If the data quality is low, it may be difficult or impossible to create models and systems with the desired performance. - **Verify development datasets are representative**: of expected operational environment and data collection means. Compare distributions of dataset features and labels with exploratory data analysis and assess the difference in tests on training data and tests on evaluation data (where the evaluation data must be drawn from a representative dataset.) - **Use a variety of data sets**: where available and applicable, to reflect different operating and environment conditions that are likley to be be encountered. - **Use software libraries**: and tools built for ML where possible, so that the underlying code is verified by prior use.** - **Diagnose model errors with domain SMEs**: Have problem domain SMEs investigate model errors for conditions for which the model may underperform and suggest refinements. - **Classification**: - **Use Standard Classification Performance Measures*…
definition: Decision tree learning is a supervised learning approach used in statistics, data mining, and machine learning. In this formalism, a classification or regression decision tree is used as a predictive model to draw conclusions about a set of observations.

Decision Tree Regression
type: Class
subclass of: Regression Analysis Learning
type: NamedIndividual
d3fend-id: D3A-DTR
definition: Decision Trees Regression is asupervised learning method with the goal to create a model that predicts the value of a target variable by learning simple decision rules inferred from the data features
kb-article: ## References scikit-learn. (n.d.). Decision Trees. [Link](https://scikit-learn.org/stable/modules/tree.html#tree)

Decoder Application
type: Class
subclass of: Codec Application
definition: An application that decodes digital data.

Decoy Artifact
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: may-contain
  some values from: Digital Artifact
type: NamedIndividual
may-contain: Digital Artifact
alternative label: Trap
alternative label: Lure
alternative label: Decoy
definition: A decoy is an imitation digital artifact in any sense of a digital artifact, object, or phenomenon that is intended to deceive a cyber attacker's surveillance devices or mislead their evaluation. Examples include fake files, accounts, hosts (honeypots), and network segments (honeynets).
alternative label: Decoy Object

Decoy Environment
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Deceive
subclass of: Restriction
  on property: manages
  some values from: Decoy Artifact
type: NamedIndividual
enables: Deceive
manages: Decoy Artifact
d3fend-id: D3-DE
definition: A Decoy Environment comprises hosts and networks for the purposes of deceiving an attacker.
synonym: Honeypot
kb-article: ## Technique Overview Systems in a decoy environment are typically configured so that some detectable means of communication does not have any legitimate business purpose. Any communication via these means should be logged and analyzed to find potential indicators of compromise for a possible past or future attack against other systems.

Decoy File
type: Class
subclass of: Decoy Object
subclass of: Restriction
  on property: spoofs
  some values from: File
type: NamedIndividual
kb-reference: Reference-OpenSourceIntelligenceDeceptions IllusiveNetworksLtd
kb-reference: Reference-SystemAndAMethodForIdentifyingThePresenceOfMalwareAndRansomwareUsingMini-trapsSetAtNetworkEndpoints FidelisCybersecuritySolutionsInc
kb-reference: Reference-SystemAndMethodsThereofForPreventingRansomwareFromEncryptingDataElementsStoredInAMemoryOfAComputer-basedSystem PaloAltoNetworksInc
kb-reference: Reference-SupplyChainCyber-deception Cymmetria,Inc.
spoofs: File
d3fend-id: D3-DF
definition: A file created for the purposes of deceiving an adversary.
kb-article: ## How it works The decoy file is made available as a local or network resource. Accesses to the file may be monitored. The files may be configurations, documents, executables, or other file types. ## Considerations Properties of the file such as cryptographic checksums, file creation date, file modified date, file size, file owner etc may be modified to improve the credibility of the file. ## Example * A CSV file with decoy user credentials is placed on a system. The system or network is then monitored to detect any accesses to the decoy files.

Decoy Network Resource
type: Class
subclass of: Decoy Object
subclass of: Restriction
  on property: spoofs
  some values from: Network Resource
type: NamedIndividual
kb-reference: Reference-AutomaticallyGeneratingNetworkResourceGroupsAndAssigningCustomizedDecoyPoliciesThereto IllusiveNetworksLtd
kb-reference: Reference-Deception-BasedResponsesToSecurityAttacks CrowdstrikeInc
kb-reference: Reference-DynamicSelectionAndGenerationOfAVirtualCloneForDetonationOfSuspiciousContentWithinAHoneyNetwork PaloAltoNetworksInc
kb-reference: Reference-SystemAndMethodForIdentifyingThePresenceOfMalwareUsingMini-trapsSetAtNetworkEndpoints FidelisCybersecuritySolutionsInc
spoofs: Network Resource
d3fend-id: D3-DNR
kb-article: ## How it works Decoy network resources are deployed to web application servers, network file shares, or other network based sharing services. A "honeypot" may serve a variety of decoy network resources. ## Considerations * Developing a deployment and placement strategy for the decoy network resource. * Personnel responsible for creation of decoy networks should consider the potential for resource exhaustion through denial of service attacks. ## Examples * Honeypots are typically used to mimic a known system with fake vulnerabilities. This may attract attackers to the honeypot. * Decoy accounts are also used to scan for attempted logins. The decoy accounts can provide security analysts with the attacker's potential intents and strategies. * Tarpits are used to monitor unallocated IP space for unauthorized network activity.
definition: Deploying a network resource for the purposes of deceiving an adversary.

Decoy Object
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Deceive
type: NamedIndividual
enables: Deceive
d3fend-id: D3-DO
kb-article: ## Technique Overview Decoy objects are typically configured with detectable means of communication but do not have any legitimate business purpose. Any communication via or to these objects should be logged and analyzed to find potential indicators of compromise for a possible past or future attack against other systems.
synonym: Lure
definition: A Decoy Object is created and deployed for the purposes of deceiving attackers.

Decoy Persona
type: Class
subclass of: Decoy Object
subclass of: Restriction
  on property: spoofs
  some values from: User
type: NamedIndividual
kb-reference: Reference-DecoyPersonasForSafeguardingOnlineIdentityUsingDeception
kb-reference: Reference-DecoyAndDeceptiveDataObjectTechnology Cymmetria,Inc.
spoofs: User
d3fend-id: D3-DP
kb-article: ## How it works A false online identity is created for the purposes of interacting with adversaries in a direct or indirect manner. This includes the associated email addresses, social media accounts, and other online communication profiles. ## Considerations * Include phone numbers and online social profiles as well as automatically or manually responding to contact made to the persona to improve realism. * Continuous updating and managing the decoy personas and online activity streams to ensure personas do not become stale and outdated.
definition: Establishing a fake online identity to misdirect, deceive, and or interact with adversaries.

Decoy Public Release
type: Class
subclass of: Decoy Object
type: NamedIndividual
kb-reference: Reference-MockAttackCybersecurityTrainingSystemAndMethods WOMBATSECURITYTECHNOLOGIESInc
d3fend-id: D3-DPR
kb-article: ## How it works Publicly released media includes press release, videos, or other marketing collateral. The media may include URLs, points of contact, or other identifiers to entice interaction from adversaries. ## Considerations * Information used in decoy public released media must contain enough realism to deceive and provide interaction from adversaries. * Continuous development, creation, and distribution of media and identifiers are needed to ensure adversary interaction continues over time. * Decoy public releases could be placed on platforms with different degrees of ownership, including entirely enterprise-owned infrastructure, IaaS, and SaaS (including social applications). Platforms that are not entirely enterprise-owned may be more likely to gather information
definition: Issuing publicly released media to deceive adversaries.

Decoy Session Token
type: Class
subclass of: Decoy Object
subclass of: Restriction
  on property: spoofs
  some values from: Session Token
type: NamedIndividual
kb-reference: Reference-DecoyAndDeceptiveDataObjectTechnology CymmetriaInc
spoofs: Session Token
d3fend-id: D3-DST
definition: An authentication token created for the purposes of deceiving an adversary.
kb-article: ## How it works Usage of decoy session tokens may be monitored to track attacker behavior or otherwise control the beliefs of the attacker. ## Considerations * Interaction and activity with the decoy session token must be constantly monitored and analyzed to detect unauthorized activity. * Session tokens are typically short-lived and therefore the decoy must be continuously updated to provide the appearance of it being used in the production environment. * Automated tools can assist with maintenance and updates by automatically adjusting the decoy session token and environment to mimic the production environment.

Decoy User Credential
type: Class
subclass of: Decoy Object
subclass of: Restriction
  on property: spoofs
  some values from: Credential
type: NamedIndividual
kb-reference: Reference-DecoyAndDeceptiveDataObjectTechnology CymmetriaInc
kb-reference: Reference-DecoyNetwork-BasedServiceForDeceivingAttackers-AmazonTechnologies
kb-reference: Reference-SystemAndMethodForIdentifyingThePresenceOfMalwareUsingMini-trapsSetAtNetworkEndpoints FidelisCybersecuritySolutionsInc
spoofs: Credential
d3fend-id: D3-DUC
kb-article: ## How it works A detection analytic is developed to determine when a user uses decoy credentials. Subsequent actions by that user may be monitored or controlled by the defender. A credential may be: * Domain username and password * Local system username and password ## Considerations * Decoy credentials should be integrated with a larger decoy environment to ensure that when decoy credentials are compromised, the credentials are used to interact with a decoy asset that is being monitored. * Continuous maintenance and updates are needed to ensure the legitimacy of the larger decoy environment and specifically the assets that utilize the decoy credentials.
definition: A Credential created for the purpose of deceiving an adversary.

Deep Convolutional GAN
type: Class
subclass of: Image Synthesis GAN
type: NamedIndividual
d3fend-id: D3A-DCG
synonym: DCGAN
definition: Deep Convolutional GAN (DCGAN) uses convolutional and convolutional-transpose layers in the generator and discriminator, respectively.
kb-article: ## References Analytics Vidhya. (2021). Deep Convolutional Generative Adversarial Network (DCGAN) for Beginners. [Link](https://www.analyticsvidhya.com/blog/2021/07/deep-convolutional-generative-adversarial-network-dcgan-for-beginners/)

Deep Neural Network Classification
type: Class
subclass of: Artificial Neural Network Classification
type: NamedIndividual
d3fend-id: D3A-DNNC
definition: A deep neural network (DNN) is an artificial neural network (ANN) with multiple layers between the input and output layers. There are different types of neural networks but they always consist of the same components: neurons, synapses, weights, biases, and functions. These components as a whole function similarly to a human brain, and can be trained like any other ML algorithm
kb-article: ## References Deep learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Deep_learning).

Deep Q-learning
type: Class
subclass of: Q-Learning
type: NamedIndividual
d3fend-id: D3A-DQL
definition: Uses a deep convolutional neural network, with layers of tiled convolutional filters to mimic the effects of receptive fields.
kb-article: ## References Q-learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Q-learning#Deep_Q-learning).

Default User Account
type: Class
subclass of: UserAccount
type: NamedIndividual
definition: Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems or default factory/provider set accounts on other types of systems, software, or devices.

Defense Evasion Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Defense Evasion
type: NamedIndividual
enables: Defense Evasion

Defensive Action
type: Class
subclass of: Cyber Action

Defensive Tactic
type: Class
subclass of: Goal
subclass of: Restriction
  on property: enabled-by
  some values from: Defensive Technique
definition: A plan for attaining a particular goal.

Defensive Technique
type: Class
subclass of: Cyber Technique
subclass of: Restriction
  on property: enables
  some values from: Defensive Tactic
subclass of: Restriction
  on property: kb-reference
  some values from: Technique Reference
subclass of: Restriction
  on property: d3fend-id
  some values from: string
subclass of: Restriction
  on property: date
  some values from: dateTime
type: NamedIndividual
display-baseurl: /technique/
synonym: Technical Security Control
synonym: Defensive Capability Feature
definition: A method which makes a computer system more difficult to attack.
synonym: Countermeasure Technique

Delete File
type: Class
subclass of: System Call
subclass of: Restriction
  on property: deletes
  some values from: File
type: NamedIndividual
deletes: File
definition: Remove a file from a machine.

Density-based Clustering
type: Class
subclass of: Cluster Analysis
type: NamedIndividual
d3fend-id: D3A-DBC
definition: Density-based clustering connects areas of high example density into clusters. This allows for arbitrary-shaped distributions as long as dense areas can be connected.
kb-article: ## References Google Developers. (n.d.). Clustering algorithms. [Link](https://developers.google.com/machine-learning/clustering/clustering-algorithms)

Density-weighted Method
type: Class
subclass of: Active Learning
type: NamedIndividual
d3fend-id: D3A-DWM
kb-article: ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).
definition: An Actvie Learning technique that uses a density estimate meta-parameter to avoid sampling sparsely populated regions of the feature space and can be based parametrically or from a parameter free model.

Deontic Logic
type: Class
subclass of: Modal Logic
type: NamedIndividual
d3fend-id: D3A-DL
definition: Deontic logic addresses the modality of obligations and norms; i.e., the modality of morality.
kb-article: ## References 1. Deontic logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Deontic_logic)

Dependency
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: dependent
  some values from: D3FEND Core
subclass of: Restriction
  on property: provider
  some values from: D3FEND Core
type: NamedIndividual
dependent: D3FEND Core
provider: D3FEND Core
definition: A dependency is the relationship of relying on or being controlled by someone or something else. This class reifies dependencies that correspond to the object property depends-on.

Description Logic
type: Class
subclass of: Symbolic AI
type: NamedIndividual
d3fend-id: D3A-DL
kb-article: ## How it works The core reasoning problems for description logics (DLs) are (usually) decidable, and efficient decision procedures have been designed and implemented for these problems. There are general, spatial, temporal, spatiotemporal, and fuzzy description logics, and each description logic features a different balance between expressive power and reasoning complexity by supporting different sets of mathematical constructors. DLs are used in artificial intelligence to describe and reason about the relevant concepts of an application domain (known as terminological knowledge). It is of particular importance in providing a logical formalism for ontologies and the Semantic Web: the Web Ontology Language (OWL) and its profiles are based on DLs. ## References 1. Description logic. (2023, April 16). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Description_logic)
definition: A description logic (DL) is a form of logic usually more expressive than propositional logic but less expressive than first-order logic.

Descriptive Statistics
type: Class
subclass of: Statistical Method
type: NamedIndividual
d3fend-id: D3A-DS
kb-article: ## References Wikipedia. (n.d.). Descriptive statistics. [Link](https://en.wikipedia.org/wiki/Descriptive_statistics)
definition: Descriptive statistics provide simple summaries about the sample and about the observations that have been made.

Deserialization Function
type: Class
subclass of: Subroutine
type: NamedIndividual
definition: Function with an input of serialized data which deserializes that data, usually with data parsing methods.

Desktop Computer
type: Class
subclass of: Personal Computer
definition: A desktop computer is a personal computer designed for regular use at a single location on or near a desk or table due to its size and power requirements. The most common configuration has a case that houses the power supply, motherboard (a printed circuit board with a microprocessor as the central processing unit (CPU), memory, bus, and other electronic components, disk storage (usually one or more hard disk drives, solid state drives, optical disc drives, and in early models a floppy disk drive); a keyboard and mouse for input; and a computer monitor, speakers, and, often, a printer for output. The case may be oriented horizontally or vertically and placed either underneath, beside, or on top of a desk.

Detect
type: Class
subclass of: Defensive Tactic
type: NamedIndividual
type: Defensive Tactic
definition: The detect tactic is used to identify adversary access to or unauthorized activity on computer networks.
display-order: 1
display-priority: 0

Detection Event
type: Class
subclass of: Security Event
type: NamedIndividual
related: Detect
definition: An event capturing the identification of a potential security issue, such as unauthorized access attempts, policy violations, or anomalous activities. Detection events form the foundation of cybersecurity monitoring and response.

Developer Application
type: Class
subclass of: UserApplication
definition: An application used to develop computer software including applications used for software construction, analysis, testing, packaging, or management.

Dial Up Modem
type: Class
subclass of: Modem
definition: A dial-up modem transmits computer data over an ordinary switched telephone line that has not been designed for data use. This contrasts with leased line modems, which also operate over lines provided by a telephone company, but ones which are intended for data use and do not impose the same signaling constraints. The modulated data must fit the frequency constraints of a normal voice audio signal, and the modem must be able to perform the actions needed to connect a call through a telephone exchange, namely: picking up the line, dialing, understanding signals sent back by phone company equipment (dial tone, ringing, busy signal,) and on the far end of the call, the second modem in the connection must be able to recognize the incoming ring signal and answer the line.

Differential Volume Snapshot
type: Class
subclass of: VolumeSnapshot
definition: A differential volume snapshot is a point-in-time capture of the files and directories that were changed since the last full snapshot.

Digital Artifact
type: Class
subclass of: Artifact
type: NamedIndividual
definition: An information-bearing artifact (object) that is, or is encoded to be used with, a digital computer system. This concept is broad to include the literal instances of an artifact, or an implicit summarization of changes to or properties of other artifacts.
display-baseurl: /dao/artifact/
synonym: Digital Asset

Digital Audio
type: Class
subclass of: Digital Media
definition: Digital audio is a representation of sound recorded in, or converted into, digital form.

Digital Audio Visual Media
type: Class
subclass of: Digital Multimedia
definition: Audiovisual (AV) is electronic media possessing both a sound and a visual component.

Digital Document
type: Class
subclass of: Digital Media
definition: An digital document is any electronic media content (other than computer programs or system files) that is intended to be used in either an electronic form or as printed output.

Digital Event
type: Class
subclass of: Event
type: NamedIndividual
definition: A digital event represents an observable occurrence, action, or state change within digital systems, networks, or their interactions. These events are characterized by their impact on the confidentiality, integrity, availability, or functionality of digital resources, processes, identities, or communications. Digital events are essential units of information in cybersecurity, serving as the basis for detecting threats, analyzing anomalies, and orchestrating responses in complex, interconnected environments.

Digital Event Record
type: Class
subclass of: Record
subclass of: Restriction
  on property: records
  some values from: Digital Event
type: NamedIndividual
records: Digital Event
definition: A digital event record is a structured representation of a digital event, encapsulating all relevant details about the occurrence for storage, analysis, and response. These records serve as the primary artifacts for cybersecurity operations, enabling threat detection, forensic investigations, and compliance reporting. Digital event records include metadata such as timestamps, origin, context, and associated resources, ensuring traceability and actionable intelligence in digital ecosystems.

Digital Fingerprint
type: Class
subclass of: Identifier
definition: A digital signature uniquely identifies data and has the property that changing a single bit in the data will cause a completely different message digest to be generated.

Digital Identity
type: Class
subclass of: Digital Information
subclass of: Restriction
  on property: identified-by
  some values from: Identifier
type: NamedIndividual
identified-by: Identifier
definition: The unique representation of a subject engaged in an online transaction. A digital identity is always unique in the context of a digital service, but does not necessarily need to uniquely identify the subject in all contexts. In other words, accessing a digital service may not mean that the subject's real-life identity is known. Note: There is no single, widely accepted definition for this term and context is important. This definition is specific to online transactions.
comment: Variously describes or designates. Designation is not compete or definite without context. The representation generally can be identified by a unique identifier, though this may be private information.

Digital Image
type: Class
subclass of: Digital Media
definition: A digital image is a pixel-based visual representation stored in formats like JPEG or PNG, used for various digital applications.

Digital Information
type: Class
subclass of: Digital Artifact
definition: Digital information is a broad category of encoded representations in digital form that convey meaning, instructions, or functionality.

Digital Information Bearer
type: Class
subclass of: Digital Artifact
definition: A digital information bearer is a physical or virtual entity that stores, transmits, or processes digital information.

Digital Media
type: Class
subclass of: Digital Information
type: NamedIndividual
definition: Digital media refers to any communication media that operate in conjunction with various encoded machine-readable data formats.

Digital Message
type: Class
subclass of: Digital Information Bearer
definition: A discrete unit of digital communication created by a sender for one or more intended recipients. Encoded in an application-layer format, a digital message conveys semantics such as commands, data, or status and is transported inside lower-layer containers like network frames or packets.

Digital Multimedia
type: Class
subclass of: Digital Media
type: NamedIndividual
definition: Digital Multimedia refers to content that combines text, audio, images, animations, and video in a digital format for interactive applications.

Digital System
type: Class
subclass of: Digital Information Bearer
subclass of: System
type: NamedIndividual
definition: A digital system is a group of interacting or interrelated digital artifacts that act according to a set of rules to form a unified whole. A digital system, surrounded and influenced by its environment, is described by its boundaries, structure and purpose and expressed in its functioning. Systems are the subjects of study of systems theory.

Digital Text
type: Class
subclass of: Digital Media
definition: Digital text is written content encoded in a digital format, allowing for storage, retrieval, and manipulation by electronic devices.

Digital Video
type: Class
subclass of: Digital Media
definition: Digital video is an electronic representation of moving visual images (video) in the form of encoded digital data.

Dimension Reduction
type: Class
subclass of: UnsupervisedLearning
type: NamedIndividual
d3fend-id: D3A-DR
definition: Dimensionality reduction is a key technique within unsupervised learning. It compresses the data by finding a smaller, different set of variables that capture what matters most in the original features, while minimizing the loss of information.
kb-article: ## References O'Reilly Media. (n.d.). Chapter 7. Machine Learning and Security: Protecting Systems with Data and Algorithms. [Link](https://www.oreilly.com/library/view/machine-learning-and/9781492073048/ch07.html)

Direct Physical Link Mapping
type: Class
subclass of: Physical Link Mapping
type: NamedIndividual
kb-reference: Reference-NetworkMapping
d3fend-id: D3-DPLM
kb-article: ## How it works Direct Physical Link Mapping involves a manual process where a network engineer or administrator physically observes and documents the physical connections within the network infrastructure. ## Considerations * Constructing and maintaining physical topologies for extensive networks can be challenging and time-consuming using manual methods. Therefore, where feasible, automated methods like active physical link mapping should be considered as a partial or complete solution for physical link mapping processes. * In scenarios where active physical link mapping is not an option, physical inspection of networks is necessary to accomplish physical link mapping. This is due to the lack of reliable techniques to accurately map physical links solely through passive network traffic monitoring.
definition: Direct physical link mapping creates a physical link map by direct observation and recording of the physical network links.
synonym: Manual Physical Link Mapping

Directory
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: may-contain
  some values from: File
type: NamedIndividual
may-contain: File
definition: In computing, a directory is a file system cataloging structure which contains references to other computer files, and possibly other directories. On many computers, directories are known as folders, or drawers to provide some relevancy to a workbench or the traditional office file cabinet.

Directory Service
type: Class
subclass of: Network Service
type: NamedIndividual
definition: In computing, directory service or name service maps the names of network resources to their respective network addresses. It is a shared information infrastructure for locating, managing, administering and organizing everyday items and network resources, which can include volumes, folders, files, printers, users, groups, devices, telephone numbers and other objects. A directory service is a critical component of a network operating system. A directory server or name server is a server which provides such a service. Each resource on the network is considered an object by the directory server. Information about a particular resource is stored as a collection of attributes associated with that resource or object.

Discovery Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Discovery
type: NamedIndividual
enables: Discovery

Discriminant Analysis
type: Class
subclass of: Multivariate Analysis
type: NamedIndividual
d3fend-id: D3A-DA
kb-article: ## References Wikipedia. (n.d.). Multivariate statistics. [Link](https://en.wikipedia.org/wiki/Multivariate_statistics)
definition: Discriminant analysis attempts to establish whether a set of variables can be used to distinguish between two or more groups of cases.

Disk Encryption
type: Class
subclass of: Platform Hardening
subclass of: Restriction
  on property: encrypts
  some values from: Storage
type: NamedIndividual
encrypts: Storage
kb-reference: Reference-LUKS1On-DiskFormatSpecificationVersion1.2.3
d3fend-id: D3-DENCR
definition: Encrypting a hard disk partition to prevent cleartext access to a file system.

Disk Erasure
type: Class
subclass of: Disk Formatting
subclass of: Restriction
  on property: erases
  some values from: Secondary Storage
type: NamedIndividual
erases: Secondary Storage
kb-reference: Reference-Remembranceofdatapassed:Astudyofdisksanitizationpractices
d3fend-id: D3-DKE
kb-article: ### How it works Disk Erasure involves overwriting the existing data with random or specific patterns multiple times. Disk erasure is crucial for data sanitization, ensuring that sensitive information is completely removed from storage devices before they are repurposed, disposed of, or transferred to another party.
definition: Disk Erasure is the process of securely deleting all data on a disk to ensure that it cannot be recovered by any means.

Disk Formatting
type: Class
subclass of: Object Eviction
subclass of: Restriction
  on property: modifies
  some values from: Secondary Storage
type: NamedIndividual
kb-reference: Reference-Remembranceofdatapassed:Astudyofdisksanitizationpractices
modifies: Secondary Storage
d3fend-id: D3-DKF
definition: Disk Formatting is the process of preparing a data storage device, such as a hard drive, solid-state drive, or USB flash drive, for initial use.
kb-article: ### How it works This process involves setting up an empty file system on the disk, which includes creating a directory structure and initializing metadata structures. In cybersecurity, disk formatting can be used to remove all existing data on a disk, making it a clean slate for new data storage or to prevent unauthorized access to previously stored data.

Disk Image
type: Class
subclass of: Storage Image
definition: A disk image is a snapshot of a storage device's structure and data typically stored in one or more computer files on another storage device.

Disk Partitioning
type: Class
subclass of: Disk Formatting
subclass of: Restriction
  on property: creates
  some values from: Partition Table
type: NamedIndividual
creates: Partition Table
kb-reference: Reference-Remembranceofdatapassed:Astudyofdisksanitizationpractices
d3fend-id: D3-DKP
definition: Disk Partitioning is the process of dividing a disk into multiple distinct sections, known as partitions.
kb-article: ### How it works Each partition can be managed separately and can have its own file system. Disk partitioning can be used to segregate sensitive data from less critical data, improve system performance, and enhance data management and recovery processes. It can also help in isolating different operating systems or environments on the same physical disk.

Display Adapter
type: Class
subclass of: Output Device
type: NamedIndividual
definition: A graphics card (also called a display card, video card, display adapter, or graphics adapter) is an expansion card which generates a feed of output images to a display device (such as a computer monitor). Frequently, these are advertised as discrete or dedicated graphics cards, emphasizing the distinction between these and integrated graphics. At the core of both is the graphics processing unit (GPU), which is the main part that does the actual computations, but should not be confused with the video card as a whole, although "GPU" is often used to refer to video cards.
alternative label: Display Card
alternative label: Graphics Adapter
alternative label: Video Card

Display Device Driver
type: Class
subclass of: Hardware Driver
subclass of: Restriction
  on property: drives
  some values from: Display Adapter
type: NamedIndividual
drives: Display Adapter
definition: A device driver for a display adapter.

Display Server
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A display server or window server is a program whose primary task is to coordinate the input and output of its clients to and from the rest of the operating system, the hardware, and each other. The display server communicates with its clients over the display server protocol, a communications protocol, which can be network-transparent or simply network-capable. The display server is a key component in any graphical user interface, specifically the windowing system.
alternative label: Window Server

Distribution-based Clustering
type: Class
subclass of: Cluster Analysis
type: NamedIndividual
d3fend-id: D3A-DBC
definition: Distribution-based clustering creates and groups data points based on their likely hood of belonging to the same probability distribution (Gaussian, Binomial, etc.) in the data.
kb-article: ## References AnalytixLabs. (n.d.). Types of Clustering Algorithms. [Link](https://www.analytixlabs.co.in/blog/types-of-clustering-algorithms/#:~:text=Distribution-Based)

Distribution Properties
type: Class
subclass of: Descriptive Statistics
type: NamedIndividual
d3fend-id: D3A-DP
definition: The properties derived from a probability distribution.
kb-article: ## References Wikipedia. (n.d.). Probability distribution. [Link](https://en.wikipedia.org/wiki/Probability_distribution)

Divisive Clustering
type: Class
subclass of: Hierarchical Clustering
type: NamedIndividual
d3fend-id: D3A-DC
definition: A divisive clustering approach is a hierarchical, top-down approach to clustering a dataset.

Document File
type: Class
subclass of: File
subclass of: Restriction
  on property: may-contain
  some values from: Executable Script
type: NamedIndividual
may-contain: Executable Script
definition: A document is a written, drawn, presented or recorded representation of thoughts. An electronic document file is usually used to describe a primarily textual file, along with its structure and design, such as fonts, colors and additional images.

Domain Account Monitoring
type: Class
subclass of: UserBehaviorAnalysis
subclass of: Restriction
  on property: monitors
  some values from: Domain User Account
type: NamedIndividual
kb-reference: Reference-AuditUserAccountManagement
monitors: Domain User Account
d3fend-id: D3-DAM
definition: Monitoring the existence of or changes to Domain User Accounts.

Domain Name
type: Class
subclass of: Identifier
subclass of: Restriction
  on property: identifies
  some values from: IP Address
type: NamedIndividual
identifies: IP Address
definition: A domain name is an identification string that defines a realm of administrative autonomy, authority or control within the Internet. Domain names are formed by the rules and procedures of the Domain Name System (DNS). Any name registered in the DNS is a domain name.Domain names are used in various networking contexts and application-specific naming and addressing purposes. In general, a domain name represents an Internet Protocol (IP) resource, such as a personal computer used to access the Internet, a server computer hosting a web site, or the web site itself or any other service communicated via the Internet. In 2015, 294 million domain names had been registered.

Domain Name Reputation Analysis
type: Class
subclass of: Identifier Reputation Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Domain Name
type: NamedIndividual
analyzes: Domain Name
kb-reference: Reference-Database for receiving storing and compiling information about email messages
kb-reference: Reference-Finding phishing sites
d3fend-id: D3-DNRA
definition: Analyzing the reputation of a domain name.

Domain Registration
type: Class
subclass of: Digital Information
subclass of: Restriction
  on property: may-contain
  some values from: Domain Name
type: NamedIndividual
may-contain: Domain Name
alternative label: Domain Name Registration Data
definition: A domain registration, or domain name registration data, is the relevant registration data from Internet resources such as domain names, IP addresses, and autonomous system numbers. Registration data is typically retrieved by means of either the Registration Data Access Protocol (RDAP) or its predecessor, the WHOIS protocol.

Domain Registration Takedown
type: Class
subclass of: Object Eviction
subclass of: Restriction
  on property: deletes
  some values from: Domain Registration
type: NamedIndividual
deletes: Domain Registration
kb-reference: Reference-UnderstandingtheDomainRegistrationBehaviorofSpammers
d3fend-id: D3-DRT
kb-article: ## How it works Most nameserver hosts and domain name registrars comply with internationally recognised standards and supply their services based on terms and conditions that provide users and organisations protection from abuse and trademark infringement. Performing a WHOIS query on the attacker's domain will provide a contact that can be notified in the case of abuse. Formal takedown processes should be initiated to suspend or disable the normal function of the domain name. ## Considerations - Takedown notifications should clearly demonstrate (with evidence) that the nameserver or registrars Terms and Conditions have been breached. - Takedown processes are notoriously slow and sometimes unsuccessful. - Many government organisations will have takedown processes that should also be followed. They may use this for intelligence to assist other organisations suffering an attack. - Top level domain registrars will have takedown processes that can be followed, as an escalation path, when the nameserver host and/or registrar have not responded or complied timeously or inline with the TLD expectations. ## Examples of Domain Registration Abuse Attackers will create infrastructure from which to carry out their operations and this may include registering domain names to be used in the various attacks. Known misuse cases include: - Registering domain names that are similar to the victim's. This is known as typosquatting or URL hijacking. Legitimate looking mails or URLs could be sent using this domain in phishing campaigns. - Registring domain names that are used in C2 beacons.
definition: The process of performing a takedown of the attacker's domain registration infrastructure.

Domain Trust Policy
type: Class
subclass of: Access Policy Administration
subclass of: Restriction
  on property: restricts
  some values from: Directory Service
subclass of: Restriction
  on property: restricts
  some values from: Domain Account
type: NamedIndividual
kb-reference: Reference-HowTrustRelationshipsWorkForResourceForestsInAzureActiveDirectoryDomainServices
restricts: Directory Service
restricts: Domain Account
d3fend-id: D3-DTP
definition: Restricting inter-domain trust by modifying domain configuration.

Domain User Account
type: Class
subclass of: UserAccount
type: NamedIndividual
definition: A domain user account in Microsoft Windows (2000) defines that user's access to a logical group of network objects (computers, users, devices) that share the same Active Directory databases; that is, a user's access to a domain.

Driver Load Integrity Checking
type: Class
subclass of: Platform Hardening
subclass of: Restriction
  on property: authenticates
  some values from: Hardware Driver
type: NamedIndividual
authenticates: Hardware Driver
kb-reference: Reference-IntegrityAssuranceThroughEarlyLoadingInTheBootPhase CrowdstrikeInc
kb-reference: Reference-ProtectedComputingEnvironment MicrosoftTechnologyLicensingLLC
d3fend-id: D3-DLIC
definition: Ensuring the integrity of drivers loaded during initialization of the operating system.
kb-article: ## How it works This technique can be accomplished in a number of ways: * A kernel level security agent installed on a host machine ensures that the driver associated with the agent is first in the initialization order. A dependent DLL associated with the driver is configured to be processed before other dependent DLLs and executes a number of operations to ensure the driver associated with the security agent is initialized first. * Kernel components can be signed by a certificate obtained by a third party to verify the source of the component and whether it has been modified. When signed, the component will include a signature block implemented as a hash value of the component header and can also include a certificate chain. The signature and certificate data are typically added before the kernel component is distributed to the public. ## Considerations * The private keys to sign certificates as reputable companies have been stolen in the past -- in cases such as where certificates from Adobe, Realtek, and JMicron have been used to sign malicious executables. (Source: https://resources.infosecinstitute.com/cybercrime-exploits-digital-certificates/#gref) * Trusted Root Certificate Authorities have been compromised, yielding the ability to use the compromised keys to generate certificates with an arbitrary company name. * It may not be difficult for an attacker to start an organization which can obtain a signed certificate. * A root certificate authority (CA) whose certificate is trusted in the verification logic could generate incorrect certificates, if they are lax or have ulterior motives.

Dyna-Q
type: Class
subclass of: Model-based Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-DQ
definition: A Dyna-Q agent combines acting, learning, and planning.
kb-article: ## References CompNeuro Neuromatch Academy Tutorials. [Link](https://compneuro.neuromatch.io/tutorials/W3D4_ReinforcementLearning/student/W3D4_Tutorial4.html)

Dynamic Analysis
type: Class
subclass of: File Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Document File
subclass of: Restriction
  on property: analyzes
  some values from: Executable File
type: NamedIndividual
analyzes: Document File
analyzes: Executable File
kb-reference: Reference-MalwareAnalysisSystem PaloAltoNetworksInc
kb-reference: Reference-UseOfAnApplicationControllerToMonitorAndControlSoftwareFileAndApplicationEnvironments SophosLtd
d3fend-id: D3-DA
definition: Executing or opening a file in a synthetic "sandbox" environment to determine if the file is a malicious program or if the file exploits another program such as a document reader.
synonym: Malware Sandbox
synonym: Malware Detonation
kb-article: ## How it works Analyzing the interaction of a piece of code with a system while the code is being executed in a controlled environment such as a sandbox, virtual machine, or simulator. This exposes the natural behavior of the piece of code without requiring the code to be disassembled. ## Considerations * Malware often detects a fake environment, then changes its behavior accordingly. For example, it could detect that the system clock is being sped up in an effort to get it to execute commands that it would normally only execute at a later time, or that the hardware manufacturer of the machine is a virtualization provider. * Malware can attempt to determine if it is being debugged, and change its behavior accordingly. * For maximum fidelity, the simulated and real environments should be as similar as possible because the malware could perform differently in different environments. * Sometimes the malware behavior is triggered only under certain conditions (on a specific system date, after a certain time, or after it is sent a specific command) and can't be detected through a short execution in a virtual environment. ## Implementations * Cuckoo Sandbox

Dynamic Analysis Tool
type: Class
subclass of: Code Analyzer
definition: Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor.

Email
type: Class
subclass of: Document File
subclass of: Restriction
  on property: may-contain
  some values from: File
subclass of: Restriction
  on property: may-contain
  some values from: URL
type: NamedIndividual
may-contain: File
may-contain: URL
definition: An email, or email message, is a document that is sent between computer users across computer networks.

Email Attachment
type: Class
subclass of: Document File
subclass of: Restriction
  on property: attached-to
  some values from: Email
type: NamedIndividual
attached-to: Email
definition: An email attachment is a computer file sent along with an email message. One or more files can be attached to any email message, and be sent along with it to the recipient. This is typically used as a simple method to share documents and images.

Email Event
type: Class
subclass of: Application Layer Event
subclass of: TCP Event
subclass of: Restriction
  on property: has-participant
  some values from: Mail Network Traffic
definition: An event involving email communication, including sending, receiving, and processing emails. Email events encapsulate activities essential to the transmission and analysis of email messages in a networked environment.

Email Filtering
type: Class
subclass of: Inbound Traffic Filtering
subclass of: Restriction
  on property: filters
  some values from: Email
type: NamedIndividual
filters: Email
kb-reference: Reference-SystemAndMethodForProvidingAnonymousRemailingAndFilteringOfElectronicMail Nokia
d3fend-id: D3-EF
kb-article: ## How it works Mail filters can be implemented to scan inbound email messages at the initial SMTP connection stage to detect and reject email containing spam and malware. This technique is distinct from d3f:EmailDeletion because it prevents an email from reaching an user's inbox. This technique can also be used for outbound email traffic. ## Considerations * The effectiveness of mail filters depend on the completeness of the filter policies
definition: Filtering incoming email traffic based on specific criteria.

Email Receive Event
type: Class
subclass of: Email Event
subclass of: Restriction
  on property: preceded-by
  some values from: Email Send Event
definition: An event where an email is delivered to a recipient's mail server or mailbox. This includes receiving messages from internal or external sources via protocols such as IMAP, POP3, or their secure variants.

Email Removal
type: Class
subclass of: File Eviction
subclass of: Restriction
  on property: deletes
  some values from: Email
subclass of: Restriction
  on property: may-access
  some values from: Mail Server
type: NamedIndividual
deletes: Email
kb-reference: Reference-SystemAndMethodForScanningRemoteServicesToLocateStoredObjectsWithMalware
may-access: Mail Server
d3fend-id: D3-ER
kb-article: ## How it works Email removal is a technique that can be used to prevent a user from executing malware or responding to phishing attempts. Security software or users themselves may detect malicious or suspicious email in a local or remote mail folder email and then employ this technique. ## Considerations For email that needs to be removed, an infosec organization may choose to take additional follow-up actions (such as blocking the sources or notifying providers), rather than only relying on email deletion. For the case where users detect likely suspicious email files, the organization should consider implementing a means for reporting these emails to their infosec organization. Email files may propagate through many storage systems across the an organization's systems over time, so early detection and blocking helps avoid residual, latent stores of malicous email content in the enterprise.
synonym: Email Deletion
definition: The email removal technique deletes email files from system storage.

Email Rule
type: Class
subclass of: Application Rule
type: NamedIndividual
definition: A configuration of an email application which is used to apply logical or data processing functions to data processed by the email application.

Email Scan Event
type: Class
subclass of: Email Event
definition: An event where an email is inspected or analyzed for content, security, or compliance purposes. Scanning often involves identifying spam, detecting malware, or ensuring policy adherence before delivery or after reception.

Email Send Event
type: Class
subclass of: Email Event
definition: An event where an email is transmitted from a client to a recipient via a mail server. This process often involves protocols such as SMTP or its secure variants, with potential authentication and encryption for secure delivery.

Embedded Computer
type: Class
subclass of: Client Computer
definition: An embedded computer is a computer system -- a combination of a computer processor, computer memory, and input/output peripheral devices-that has a dedicated function within a larger mechanical or electrical system. It is embedded as part of a complete device often including electrical or electronic hardware and mechanical parts. Because an embedded system typically controls physical operations of the machine that it is embedded within, it often has real-time computing constraints. Embedded systems control many devices in common use today. Ninety-eight percent of all microprocessors manufactured are used in embedded systems.
alternative label: Embedded System

Embedded Database Application
type: Class
subclass of: Database Application
subclass of: Restriction
  on property: executes
  some values from: Database Query
subclass of: Restriction
  on property: manages
  some values from: Database
type: NamedIndividual
executes: Database Query
manages: Database
definition: A software application that integrates a database management system (DBMS) directly within its own structure, rather than relying on a separate, standalone database server. Examples include SQLite and Berkeley DB.

Emulated File Analysis
type: Class
subclass of: File Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Document File
subclass of: Restriction
  on property: analyzes
  some values from: Executable File
type: NamedIndividual
analyzes: Document File
analyzes: Executable File
kb-reference: Reference-Network-levelPolymorphicShellcodeDetectionUsingEmulation
d3fend-id: D3-EFA
definition: Emulating instructions in a file looking for specific patterns.

Enclave
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: may-contain
  some values from: Local Area Network
type: NamedIndividual
may-contain: Local Area Network
definition: Network enclaves consist of standalone assets that do not interact with other information systems or networks. A major difference between a DMZ or demilitarized zone and a network enclave is a DMZ allows inbound and outbound traffic access, where firewall boundaries are traversed. In an enclave, firewall boundaries are not traversed. Enclave protection tools can be used to provide protection within specific security domains. These mechanisms are installed as part of an Intranet to connect networks that have similar security requirements.
alternative label: Network Enclave

Encoder Application
type: Class
subclass of: Codec Application
definition: An application that encodes digital data.

Encrypted Credential
type: Class
subclass of: Credential
type: NamedIndividual
definition: A credential that is encrypted.

Encrypted Password
type: Class
subclass of: Encrypted Credential
subclass of: Password
definition: A password that is encrypted.

Encrypted Tunnels
type: Class
subclass of: Network Isolation
subclass of: Restriction
  on property: isolates
  some values from: Intranet Network
type: NamedIndividual
isolates: Intranet Network
kb-reference: Reference-SecurityArchitectureForTheInternetProtocol
d3fend-id: D3-ET
definition: Encrypted encapsulation of routable network traffic.

Endpoint-based Web Server Access Mediation
type: Class
subclass of: WebSessionAccessMediation
type: NamedIndividual
kb-reference: Reference-NIST-Special-Publication-800-41-Revision-1
d3fend-id: D3-EBWSAM
kb-article: ## How it works Endpoint-based Web Server Access Mediation focuses on managing access to web servers directly from user devices. This involves implementing security measures like client certificates or endpoint security software to ensure that only authorized devices can initiate sessions with web servers. Examples include direct access to internal web applications from company laptops.
definition: Endpoint-based web server access mediation regulates web server access directly from user endpoints by implementing mechanisms such as client-side certificates and endpoint security software to authenticate devices and ensure compliant access.

Endpoint Health Beacon
type: Class
subclass of: Operating System Monitoring
subclass of: Restriction
  on property: monitors
  some values from: Network Node
type: NamedIndividual
kb-reference: Reference-IntrusionDetectionUsingAHeartbeat SophosLtd
monitors: Network Node
d3fend-id: D3-EHB
definition: Monitoring the security status of an endpoint by sending periodic messages with health status, where absence of a response may indicate that the endpoint has been compromised.
synonym: Endpoint Health Telemetry
kb-article: ## How it works Endpoints are configured to periodically generate and transmit a secure heartbeat that is delivered on a configured schedule and provides endpoint status information. Status information can include software details (version, configuration, etc), endpoint identification (MAC, IP address, machine ID) or other hardware/software configuration information. Interruption of the heartbeat can signal that the endpoint has been compromised. ## Considerations * Security of heartbeat messages to ensure message integrity * Disappearance of the heartbeat could simply mean that the endpoint is powered off or intentionally disconnected from the network. Therefore other criteria may need to be used to accurately detect endpoint compromise. * Attacker presence on the machine may leave the heartbeat intact. * An attacker may determine the format of the heartbeat and continue to send it even after the machine is compromised.

Endpoint Sensor
type: Class
subclass of: Cyber Sensor
type: NamedIndividual
definition: A sensor application installed on a endpoint (platform) to collect information on platform components.

Ensemble Learning
type: Class
subclass of: Machine Learning
type: NamedIndividual
d3fend-id: D3A-EL
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).
definition: In statistics and machine learning, ensemble methods use multiple learning algorithms to obtain better predictive performance than could be obtained from any of the constituent learning algorithms alone

Epistemic Logic
type: Class
subclass of: Modal Logic
type: NamedIndividual
d3fend-id: D3A-EL
definition: Epistemic logic addresses modalities of knowledge; i.e., the certainty of sentences.
kb-article: ## References 1. Epistemic logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Epistemic_logic)
synonym: Epistemic Modal Logic

Equivalence Matching
type: Class
subclass of: Logical Rules
type: NamedIndividual
d3fend-id: D3A-EM
kb-article: ## How it works Equality is a relationship between two quantities or, more generally two mathematical expressions, asserting that the quantities have the same value, or that the expressions represent the same mathematical object. Programming languages can have multiple senses of equality that may include, but are not limited to: - Identity: The objects are identical; often indicated by having values indicating the same logical address. - Equality: The values of the expessions and properties are equivalent when evaluated; they do not need to have the same logical address. ## References 1. Equality (mathematics). (2023, May 31). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Equality_(mathematics)] 2. Types of Equality. (2007, March 2). In _WikiWikiWeb_. [Link](https://wiki.c2.com/?TypesOfEquality)
definition: Equivalence matching is matching two values, which may be bound to variables, to see if they are equivalent.

Estimation
type: Class
subclass of: Inferential Statistics
type: NamedIndividual
d3fend-id: D3A-EST
definition: Estimation represents ways or a process of learning and determining the population parameter based on the model fitted to the data.
kb-article: ## References Pennsylvania State University. (n.d.). Statistical Inference and Estimation. [Link](https://online.stat.psu.edu/stat504/lesson/statistical-inference-and-estimation)

Eval Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: invokes
  some values from: Subroutine
type: NamedIndividual
invokes: Subroutine
definition: Takes inputs of strings and evaluations them as expressions.

Event
type: Class
subclass of: D3FEND Core
definition: An Event is an occurrence or action within a system, process, or environment within a finite span of time.

Event Log
type: Class
subclass of: Log
subclass of: Restriction
  on property: contains
  some values from: Digital Event Record
type: NamedIndividual
contains: Digital Event Record
definition: Event logs record events taking place in the execution of a system in order to provide an audit trail that can be used to understand the activity of the system and to diagnose problems. They are essential to understand the activities of complex systems, particularly in the case of applications with little user interaction (such as server applications).
synonym: Digital Event Log

Event Log Archive Event
type: Class
subclass of: Event Log Event
definition: An event involving the archiving of event log data, typically to preserve historical records in a compressed or secure format.

Event Log Clear Event
type: Class
subclass of: Event Log Event
definition: An event where the event log data is cleared from the system, often as part of log maintenance or potentially to cover tracks.

Event Log Delete Event
type: Class
subclass of: Event Log Event
definition: An event where the event log database, file, or cache is deleted from the system, removing the log's historical records.

Event Log Disable Event
type: Class
subclass of: Event Log Event
subclass of: Restriction
  on property: preceded-by
  some values from: Event Log Enable Event
definition: An event indicating that the event logging service has been disabled, preventing it from collecting or recording logs.

Event Log Enable Event
type: Class
subclass of: Event Log Event
definition: An event where the event logging service is enabled, allowing it to actively collect and record logs.

Event Log Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Event Log
definition: An event that captures actions or operations related to the management of system event logs, including modifications, access, and service state changes.

Event Log Export Event
type: Class
subclass of: Event Log Event
definition: An event representing the export of event log data to a file or external system for backup or analysis purposes.

Event Log Restart Event
type: Class
subclass of: Event Log Event
subclass of: Restriction
  on property: preceded-by
  some values from: Event Log Stop Event
subclass of: Restriction
  on property: precedes
  some values from: Event Log Start Event
definition: An event representing the restarting of the event logging service, often performed during system maintenance or troubleshooting.

Event Log Rotate Event
type: Class
subclass of: Event Log Event
definition: An event where the event log is rotated, often as part of log rotation policies to manage storage and ensure continuity.

Event Log Start Event
type: Class
subclass of: Event Log Event
definition: An event where the event logging service is started, enabling the collection and recording of system events.

Event Log Stop Event
type: Class
subclass of: Event Log Event
subclass of: Restriction
  on property: preceded-by
  some values from: Event Log Start Event
definition: An event indicating that the event logging service has been stopped, halting the recording of system events.

Evict
type: Class
subclass of: Defensive Tactic
type: NamedIndividual
type: Defensive Tactic
display-priority: 0
display-order: 4
definition: The eviction tactic is used to remove an adversary from a computer network.

Eviction Event
type: Class
subclass of: Security Event
subclass of: Restriction
  on property: preceded-by
  some values from: Detection Event
type: NamedIndividual
related: Evict
definition: An event describing actions to remove adversaries or malicious resources from a system, re-establishing security and operational integrity.

Exact Matching
type: Class
subclass of: Equivalence Matching
subclass of: Numeric Pattern Matching
type: NamedIndividual
d3fend-id: D3A-EM
definition: Exact matching for numeric types is just the simple test for mathematical equivalence of the values being matched.
synonym: Numeric Equivalence Matching
kb-article: ## References 1. Equality (mathematics). (2023, May 31). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Equality_(mathematics)]

Exception Handler
type: Class
subclass of: Subroutine
definition: An exception handler is a code segment that processes an exception.

Exception Handler Pointer Validation
type: Class
subclass of: Application Hardening
subclass of: Restriction
  on property: validates
  some values from: Pointer
type: NamedIndividual
kb-reference: Reference-SAFESEH ImageHasSafeExceptionHandlers MicrosoftDocs
validates: Pointer
d3fend-id: D3-EHPV
kb-article: ## How It Works When a process encounters an exception, it calls an exception handler to deal with the exception. The method by which this exception handler is determined varies by the operating system. The exception handler is called, even if it is the default exception handler to terminate the program and display a message that the program stopped working. In the case that no valid exception handler is found, the program would fail to proceed as normal and could be programmed to terminate. In Windows, the address of the exception registration record is stored at the very start of the the Thread Information Block; the GS register points to this structure. The exception registration record contains two pointers: a pointer to the next exception registration record should this handler fail to handle the exception, and a pointer to the handler. A buffer overflow can overwrite the saved return pointer with an invalid location to execute memory; this often triggers the exception handler chain, which could also be corrupted by the buffer overflow. Although Process Exception Handler Validation does not make sure that the exception handler pointer or the code at the exception handler was unaltered, or that the exception handler code is secure, this technique does ensure that the pointer is at least an exception handler that could be called by the program. With Process Exception Handler Validation, before the handler is called, it checks the exception handler against a source of valid exception handlers. If the requested handler is not in this list, other techniques such as those in Process Eviction might be invoked, such as Process Termination to end the current process, or Executable Blacklisting to blacklist the potentially vulnerable or malfunctioning executable. ### Runtime valid exception handler source generation The source of valid exception handlers could be generated at runtime, with the risk of the information that is used to determine the validity of exception ha…
definition: Validates that a referenced exception handler pointer is a valid exception handler.
synonym: Exception Handler Validation

Exec
type: Class
subclass of: System Call
subclass of: Restriction
  on property: executes
  some values from: Executable Binary
type: NamedIndividual
executes: Executable Binary

Executable Allowlisting
type: Class
subclass of: Execution Isolation
subclass of: Restriction
  on property: blocks
  some values from: Executable File
subclass of: Restriction
  on property: filters
  some values from: Create Process
type: NamedIndividual
type: Platform Hardening
blocks: Executable File
filters: Create Process
kb-reference: Reference-EnhancingNetworkSecurityByPreventingUser-InitiatedMalwareExecution
kb-reference: Reference-ComputingApparatusWithAutomaticIntegrityReferenceGenerationAndMaintenance Tripwire,Inc.
d3fend-id: D3-EAL
synonym: File Signature Authentication
definition: Using a digital signature to authenticate a file before opening.
kb-article: ## How it works This technique is generic and there are numerous ways to compute and authenticate digital signatures. A digital certificate is generated from a private/public key pair issued by a certificate authority (CA). A hash of the file is encrypted using the private key. When the file is downloaded by another user, the user's system uses the public key to decrypt the hash and a new hash is created of the downloaded file. The hash decrypted by the public key is compared to the new hash and if there is a mismatch, further techniques, such as file deletion, file quarantine, or **Executable Blacklisting** may be invoked. This technique may be invoked when deciding whether to execute a file. ## Considerations Organizations which download or create high volumes of software make management complex, in particular engineering or scientific organizations.

Executable Binary
type: Class
subclass of: Executable File
subclass of: Restriction
  on property: contains
  some values from: Image Code Segment
subclass of: Restriction
  on property: contains
  some values from: Image Data Segment
subclass of: Restriction
  on property: may-interpret
  some values from: Executable Script
type: NamedIndividual
contains: Image Code Segment
contains: Image Data Segment
may-interpret: Executable Script
definition: An executable binary contains machine code instructions for a physical CPU. D3FEND also considers byte code for a virtual machine to be binary code. This is in contrast to executable scripts written in a scripting language.

Executable Denylisting
type: Class
subclass of: Execution Isolation
subclass of: Restriction
  on property: blocks
  some values from: Executable File
subclass of: Restriction
  on property: filters
  some values from: Create Process
type: NamedIndividual
blocks: Executable File
filters: Create Process
kb-reference: Reference-MethodAndApparatusForIncreasingTheSpeedAtWhichComputerVirusesAreDetected McAfeeLLC
kb-reference: Reference-ContentExtractorAndAnalysisSystem Bit9Inc,CarbonBlackInc
d3fend-id: D3-EDL
synonym: Executable Blacklisting
definition: Blocking the execution of files on a host in accordance with defined application policy rules.
kb-article: ## How it works #### Criteria A policy-enforcing application can register an application for denylisting based on conditions including the following: * File attributes * file name * file path * file hash * file publisher, as obtained from the digital signature * permissions of the file * File malware scan (eg. Windows SmartScreen) * User-File combination This may be done to prevent execution of applications which are: * an old version with known vulnerabilities * without a valid license, which could cause legal issues * in a directory that is accessible to low-privileged users, that could be accessed by a malware dropper * known trojan horse programs * too open in their permissions, possibly set to run as a user other than the originator or allowing execution when they should not be * a match to the hash of other known malware * are detected as undesirable based on a file scan runtime behavior System administrators will customize the rules for the given environment. #### Backend The policy-enforcing program may work by running in kernel mode, and [intercepting] [system calls which execute a process]. ## Considerations * If denylisting is done by filename, filepath, or hash, these mechanisms may be a worthy first line of defense and detection, but could still be evaded by an attacker. * Continuous management is needed to keep the denylist up to date, whether it is based on hash, publisher, behavior, or any other digital artifact. * Although denylists based on attributes such as file path and virus scan could defend against some threats which they have not been explicitly coded to block, denylists may not provide protection from new, unknown, or zero day attacks. ## Examples On a Windows machine the Windows Defender Application Control (WDAC) policy enforcement is run in the kernel and allows for restricting applications.

Executable File
type: Class
subclass of: File
subclass of: Restriction
  on property: contains
  some values from: Subroutine
type: NamedIndividual
contains: Subroutine
definition: In computing, executable code or an executable file or executable program, sometimes simply an executable, causes a computer "to perform indicated tasks according to encoded instructions," as opposed to a data file that must be parsed by a program to be meaningful. These instructions are traditionally machine code instructions for a physical CPU. However, in a more general sense, a file containing instructions (such as bytecode) for a software interpreter may also be considered executable; even a scripting language source file may therefore be considered executable in this sense. The exact interpretation depends upon the use; while the term often refers only to machine code files, in the context of protection against computer viruses all files which cause potentially hazardous instruction
alternative label: Executable

Executable Script
type: Class
subclass of: Executable File
type: NamedIndividual
definition: An executable script is written in a scripting language and interpreted at run time. This is in contrast with an executable binary, which contains machine code instructions for a physical CPU or byte code for a virtual machine.

Execution Isolation
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Isolate
type: NamedIndividual
enables: Isolate
d3fend-id: D3-EI
definition: Execution Isolation techniques prevent application processes from accessing non-essential system resources, such as memory, devices, or files.

Execution Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Execution
type: NamedIndividual
enables: Execution

Exfiltration Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Exfiltration
type: NamedIndividual
enables: Exfiltration

Expectation-maximization Clustering
type: Class
subclass of: Distribution-based Clustering
type: NamedIndividual
d3fend-id: D3A-EMC
definition: An unsupervised clustering algorithm and extends to NLP applications like Latent Dirichlet Allocation, the Baum-Welch algorithm for Hidden Markov Models, and medical imaging.
kb-article: ## References Towards Data Science. (n.d.). Expectation Maximization Explained. [Link](https://towardsdatascience.com/expectation-maximization-explained-c82f5ed438e5#:~:text=Expectation%20Maximization%20(EM)%20is%20a,Markov%20Models%2C%20and%20medical%20imaging.)

Expected Error Reduction
type: Class
subclass of: Active Learning
type: NamedIndividual
d3fend-id: D3A-EER
definition: Expected Error Reduction (EER) follows similar ideas as EMC, but again looks at the model output instead of the model itself and also takes the other data into account. In particular, a sample x is considered useful, if we can expect that knowing the label will reduce the future error on unseen samples
kb-article: ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).

Expected Model Change
type: Class
subclass of: Active Learning
type: NamedIndividual
d3fend-id: D3A-EMC
definition: Supervised learning establishes a relationship between the known input and output variables to conduct a predictive analysis.
kb-article: nal Consiterations ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).

External Content Inclusion Function
type: Class
subclass of: Subroutine
type: NamedIndividual
definition: External content, strings or data, are inserted into a local document (e.g. xml document) as if it were a native part of that document.

External Control
type: Class
subclass of: External Control Thing
subclass of: Restriction
  on property: member-of
  some values from: Control Catalog
subclass of: Restriction
  on property: semantic-relation
  some values from: Defensive Technique

External Control Thing
type: Class
subclass of: External Thing

External Knowledge Base
type: Class
subclass of: Technique Reference
pref-label: External Knowledge Base

External Thing
type: Class

External Threat Model Thing
type: Class
subclass of: External Thing

FTP Delete Event
type: Class
subclass of: FTP Event
subclass of: Restriction
  on property: preceded-by
  some values from: FTP Put Event
definition: An event where files or directories are removed from an FTP server, resulting in their permanent deletion from the remote system.

FTP Event
type: Class
subclass of: Application Layer Event
subclass of: TCP Event
subclass of: Restriction
  on property: has-participant
  some values from: File Transfer Network Traffic
definition: An event involving the File Transfer Protocol (FTP), a standard network protocol used to transfer files between a client and server over a TCP/IP network. FTP facilitates operations such as file uploads, downloads, directory listing, and remote file management.

FTP Get Event
type: Class
subclass of: FTP Event
subclass of: Restriction
  on property: preceded-by
  some values from: FTP Put Event
definition: An event where a file is downloaded from an FTP server to a client, retrieving data from the remote system to the local destination.

FTP List Event
type: Class
subclass of: FTP Event
definition: An event where the contents of a directory on an FTP server are listed, providing metadata such as file names, sizes, and timestamps.

FTP Poll Event
type: Class
subclass of: FTP Event
definition: An event where a client queries an FTP server to check for the presence of specific files or directories without initiating a transfer.

FTP Put Event
type: Class
subclass of: FTP Event
definition: An event where a file is uploaded from a client to an FTP server, transferring data from the local system to the remote destination.

FTP Rename Event
type: Class
subclass of: FTP Event
subclass of: Restriction
  on property: preceded-by
  some values from: FTP Put Event
definition: An event where files or directories on an FTP server are renamed, modifying their identifiers without altering their content or location.

Fast Symbolic Link
type: Class
subclass of: Symbolic Link
subclass of: UnixLink
disjoint with: Slow Symbolic Link
definition: Fast symbolic links, allow storage of the target path within the data structures used for storing file information on disk (e.g., within the inodes). This space normally stores a list of disk block addresses allocated to a file. Thus, symlinks with short target paths are accessed quickly. Systems with fast symlinks often fall back to using the original method if the target path exceeds the available inode space.
alternative label: Fast Symlink

File
type: Class
subclass of: Resource
subclass of: Restriction
  on property: contains
  some values from: File Section
subclass of: Restriction
  on property: may-contain
  some values from: File
subclass of: Restriction
  on property: may-contain
  some values from: URL
type: NamedIndividual
contains: File Section
may-contain: URL
definition: A file maintained in computer-readable form.

File Access Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: has-participant
  some values from: File Path Open Function
subclass of: Restriction
  on property: preceded-by
  some values from: File Creation Event
definition: An event where a file is accessed for operations such as reading, opening, or inspecting its contents or metadata, without necessarily modifying its state.

File Access Pattern Analysis
type: Class
subclass of: Process Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Local Resource Access
type: NamedIndividual
analyzes: Local Resource Access
kb-reference: Reference-File-modifyingMalwareDetection CrowdstrikeInc
d3fend-id: D3-FAPA
definition: Analyzing the files accessed by a process to identify unauthorized activity.
kb-article: ## How it works File modifying malware such as wipers and ransomware are detected by identifying file access patterns that are associated with a malicious process. Examples of file access patterns include accessing a large number of files, accessing multiple file types, files being accessed located in multiple locations in a directory, and copying a file and encrypting the contents of that file into a copy. ## Considerations Certain file access actions may not be statistically different from authorized activity.

File Analysis
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: analyzes
  some values from: File
subclass of: Restriction
  on property: enables
  some values from: Detect
type: NamedIndividual
analyzes: File
enables: Detect
d3fend-id: D3-FA
definition: File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.
kb-article: ## Technique Overview Some techniques use file signatures or file metadata to compare against historical collections of malware. Files may also be compared against a source of ground truth such as cryptographic signatures. Examining files for potential malware using pattern matching against file contents/file behavior. Binary code may be dissembled and analyzed for predictive malware behavior, such as API call signatures. Analysis might occur within a protected environment such as a sandbox or live system.

File Carving
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: File Transfer Network Traffic
type: NamedIndividual
analyzes: File Transfer Network Traffic
kb-reference: Reference-ComputerWormDefenseSystemAndMethod FireEyeInc
d3fend-id: D3-FC
definition: Identifying and extracting files from network application protocols through the use of network stream reassembly software.
kb-article: ## How it works Protocol stream reassembly software recreates a directional byte stream by analyzing captured network packets. Once the stream is reassembled pattern matching is applied to determine if it contains a file of interest. Files of interest range from executable, archive, or document file formats. Once the file is captured, it is then processed with standard File Analysis Techniques. Example network protocols include HTTP, SMTP, FTP, HTTP/2, and TLS/HTTP/Dropbox. ## Considerations - This is an error prone process due to the intricacies of network protocols and network packet capture. For example reassembly may be done in real-time or streaming fashion, or packets may be written to disk, then bulk processed. The packets may arrive out of order, with fragmentation, duplicates, or re-transmissions. The reassembly software must compensate for the imperfect packet stream in order to recreate the well formed file which was transmitted. - File type identification can be a difficult process which can be exploited by adversaries.

File Content Analysis
type: Class
subclass of: File Analysis
type: NamedIndividual
kb-reference: Reference-CyberVaccineAndPredictiveMalwareDefensiveMethodsAndSystems
d3fend-id: D3-FCOA
kb-article: ## How it works Analyzing a piece of code without it being executed in a sandbox, virtual machine, or simulator. Patterns or signatures in the file can indicate whati kind of software it is, including whether it is malware.
definition: Employing a pattern matching algorithm to statically analyze the content of files.

File Content Block
type: Class
subclass of: File Section
type: NamedIndividual
definition: A section within a file that contains the main content or data payload.

File Content Block Data
type: Class
subclass of: Digital Information
type: NamedIndividual
definition: The actual content or main data within a file or data block.

File Content Block Metadata
type: Class
subclass of: File Metadata
definition: Content Blocks may contain metadata specific to the block's content at the beginning.

File Content Decompression Checking
type: Class
subclass of: File Format Verification
subclass of: Restriction
  on property: analyzes
  some values from: File Content Block Data
type: NamedIndividual
analyzes: File Content Block Data
kb-reference: Reference-CarvingContiguousandFragmentedFilesWithFastObjectValidation
kb-reference: Reference-GatheringEvidenceModel-DrivenSoftwareEngineeringinAutomatedDigitalForensics
d3fend-id: D3-FCDC
kb-article: ## How it works Some file formats such as JPEGs include encoded or compressed sections. This technique verfies that those expected sections are present and can be properly decoded according to the spec.
definition: Checking if compressed or encoded data sections can be successfully decompressed or decoded. Can follow with further analysis with semantic knowledge

File Content Rules
type: Class
subclass of: File Content Analysis
type: NamedIndividual
kb-reference: Reference-ComputationalModelingAndClassificationOfDataStreams CrowdstrikeInc
kb-reference: Reference-DetectingScript-basedMalware CrowdstrikeInc
kb-reference: Reference-DistributedMeta-informationQueryInANetwork Bit9Inc
kb-reference: Reference-SystemAndMethodsThereofForLogicalIdentificationOfMaliciousThreatsAcrossAPluralityOfEnd-pointDevicesCommunicativelyConnectedByANetwork PaloAltoNetworksIncCyberSecdoLtd
d3fend-id: D3-FCR
definition: Employing a pattern matching rule language to analyze the content of files.
synonym: File Signatures
kb-article: ## How it works Rules, often called signatures, are used for both generic and targeted malware detection. The rules are usually expressed in a domain specific language (DSL), then deployed to software that scans files for matches. The rules are developed and broadly distributed by commercial vendors, or they are developed and deployed by enterprise security teams to address highly targeted or custom malware. Conceptually, there are public and private rule sets. Both leverage the same technology, but they are intended to detect different types of cyber adversaries. ## Considerations * Patterns expressed in the DSLs range in their complexity. Some scanning engines support file parsing and normalization for high fidelity matching, others support only simple regular expression matching against raw file data. Engineers must make a trade-off in terms of: * The fidelity of the matching capabilities in order to balance high recall with avoiding false positives, * The computational load for scanning, and * The resilience of the engine to deal with adversarial content presented in different forms-- content which in some cases is designed to exploit or defeat the scanning engines. * Signature libraries can become large over time and impact scanning performance. * Some vendors who sell signatures have to delete old signatures over time. * Simple signatures against raw content cannot match against encoded, encrypted, or sufficiently obfuscated content. ## Implementations * YARA * ClamAV
synonym: File Content Signatures

File Copy Event
type: Class
subclass of: File Creation Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Access Event
definition: An event where a file is duplicated, creating a new file in a different location or under a different name while preserving the original file's content and attributes.

File Creation Analysis
type: Class
subclass of: System Call Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Create File
type: NamedIndividual
analyzes: Create File
kb-reference: Reference-LsassProcessDumpViaProcdump MITRE
kb-reference: Reference-CAR-2020-09-001:ScheduledTask-FileAccess MITRE
d3fend-id: D3-FCA
definition: Analyzing the properties of file create system call invocations.

File Creation Event
type: Class
subclass of: File Event
definition: An event representing the creation of a new file within the system, establishing its existence and initial attributes in the file system or storage medium.

File Decryption Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Encryption Event
definition: An event where a previously encrypted file is decoded, rendering its content accessible to authorized users or processes.

File Deletion Event
type: Class
subclass of: File Event
definition: An event where a file is permanently removed from the file system or storage medium, potentially triggering actions related to data retention or recovery.

File Encryption
type: Class
subclass of: Platform Hardening
subclass of: Restriction
  on property: encrypts
  some values from: File
type: NamedIndividual
encrypts: File
kb-reference: Reference-GuideToStorageEncryptionTechnologiesForEndUserDevices
kb-reference: Reference-SecurityConsiderationsForExchangingFilesOverTheInternet
d3fend-id: D3-FE
definition: Encrypting a file using a cryptographic key.
kb-article: ## How it Works Files are encrypted using either a single key for both encryption and decryption or separate keys. Single key encryption is symmetric encryption and using two key distinct keys is asymmetric encryption. ### Symmetric Cryptography Symmetric encryption uses the same cryptographic key for both the encryption and decryption a file. Managing keys at scale sometimes uses asymmetric key exchange. Protocols such as RSA or Diffie-Hellman can be used to share the symmetric cryptographic key with the others. ### Asymmetric Cryptography Asymmetric encryption is typically accomplished using public and private key certificates based on the X.509 standard. Files are encrypted using the public key and decrypted using their private key. Asymmetric encryption is typically slower than symmetric encryption and not widely used for large file encryption, but is popular for key wrapping, key exchanges, and digital signatures. ## Considerations - Continuous monitoring must be carried out to ensure private keys are not compromised and the certificate authority (CA) is trusted. - Transfer of private keys between multiple devices must be performed securely.

File Encryption Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Creation Event
definition: An event involving the application of cryptographic techniques to a file, ensuring its content is securely encoded and inaccessible without proper decryption keys.

File Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: File
definition: An event involving operations performed on digital files, encompassing actions such as creation, modification, deletion, access, and attribute or permission changes.

File Eviction
type: Class
subclass of: Object Eviction
subclass of: Restriction
  on property: deletes
  some values from: File
type: NamedIndividual
deletes: File
kb-reference: Reference-HowDoesAntivirusQuarantineWork-SafetyDetectives
d3fend-id: D3-FEV
definition: File eviction techniques delete files from system storage.
kb-article: ## How it works Adversaries may place files or programs into a computer's file system to perform malicious actions. As part of the eviction process, these files and programs should be removed to prevent further compromise or reinfection. Examples of malicious types of files are malware which is directly harmful and content files with the intent to deceive users (e.g., phishing.) On Windows systems, antivirus (AV) software should be used to safely and permanently remove malicious files. AV software may first quarantine a suspected malicious file, which is the process of moving a file from its original location to a new location and makes changes so that it cannot be executed. Users can then verify that the file is not benign and then permanently delete it. ## Considerations When it is determined that a file should be removed for security purposes, the organization--or systems implementing an organization's policies--may determine that the file should not simply be deleted from the enterprise's mission systems, but be quarantined to a secure system by an approved mechanism, so as to allow follow-up investigation by security staff. On Windows systems, deleting a file in File Explorer does not permanently delete a file - it sends it to the Recycle Bin instead. The Recycle Bin must be emptied, or alternative steps must be performed to remove files completely. Even then, in some cases the data may persist in disk, so data shredder tools may be needed to completely wipe a file. Thus, AV tools are recommended.

File Footer Block
type: Class
subclass of: File Section
type: NamedIndividual
definition: A section at the end of a file that contains metadata or control information.

File Footer Block Content
type: Class
subclass of: File Metadata
definition: The content of a footer block not including the signature.

File Footer Block Signature
type: Class
subclass of: File Metadata
definition: A sequence of bytes used to identify and validate the footer section within a file.

File Format Verification
type: Class
subclass of: Content Validation
subclass of: Restriction
  on property: analyzes
  some values from: File Section
type: NamedIndividual
analyzes: File Section
kb-reference: Reference-FileSecurityUsingFileFormatValidation OPSWATInc
d3fend-id: D3-FFV
definition: Verifying that a file conforms to its expected format specifications

File Get Attributes Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Access Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Creation Event
definition: An event where a file's metadata attributes, such as size, creation date, or type, are queried or retrieved without altering its content.

File Get Permissions Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Creation Event
definition: An event where a file's security settings or access control list (ACL) is retrieved, detailing permissions granted to users or processes.

File Hash
type: Class
subclass of: Digital Fingerprint
subclass of: Restriction
  on property: identifies
  some values from: File
type: NamedIndividual
identifies: File
definition: A File Hash is a fixed-length, unique digital fingerprint generated by applying a cryptographic hash function to the contents of a file.

File Hash Reputation Analysis
type: Class
subclass of: Identifier Reputation Analysis
subclass of: Restriction
  on property: analyzes
  some values from: File Hash
type: NamedIndividual
analyzes: File Hash
kb-reference: Reference-Reputation of an entity associated with a content item
d3fend-id: D3-FHRA
definition: Analyzing the reputation of a file hash.

File Hashing
type: Class
subclass of: File Analysis
type: NamedIndividual
kb-reference: Reference-Munin
d3fend-id: D3-FH
definition: Employing file hash comparisons to detect known malware.
kb-article: ## How it works This technique requires a list of hashes to compare a file against. ## Considerations Performance on large files or very large numbers of files.

File Header Block
type: Class
subclass of: File Section
type: NamedIndividual
definition: Headers are sections of a file that organize and provide information about specific sections or components of the file. Typically found at the beginning of a file, they often contain file type identification, version information, and metadata such as size, format, and encoding.

File Header Block Content
type: Class
subclass of: File Metadata
definition: The content of a header block not including the signature.

File Header Block Signature
type: Class
subclass of: File Metadata
definition: A sequence of bytes used to identify and validate specific header sections within a file.

File Integrity Monitoring
type: Class
subclass of: Platform Monitoring
subclass of: Restriction
  on property: analyzes
  some values from: File
type: NamedIndividual
analyzes: File
kb-reference: Reference-FileIntegrityMonitoringinMicrosoftDefenderforCloud-Microsoft
kb-reference: Reference-Tripwire
d3fend-id: D3-FIM
kb-article: ## How it Works There are a number of tools in Windows and Unix that can monitor specific files in a system and generate alerts if any artifacts have been created, modified, or removed. They accomplish this by comparing the current artifacts to a previous snapshot. Unix - Unix systems have a file integrity checker tool called tripwire. Tripwire first initializes a database that serves as a basis for comparison and can then scan the system to compare the state of the current file system against the initial baseline database. Additionally, users can define policies that specify potential violations. Windows - In Microsoft Azure, file integrity monitoring can be enabled which can track file and registry key creation, removals, and modifications of specific files. ## Considerations Files can change constantly due to the non-static nature of a computer system. File Integrity Monitoring works best when pointed at a narrow scope of critical files to limit the number of unneccessary files that may be modified over the course of normal use. The accuracy and precision of defined policies also affect the efficacy of this technique.
definition: Detecting any suspicious changes to files in a computer system.

File Internal Structure Verification
type: Class
subclass of: File Format Verification
subclass of: Restriction
  on property: analyzes
  some values from: File Content Block
type: NamedIndividual
analyzes: File Content Block
kb-reference: Reference-CarvingContiguousandFragmentedFilesWithFastObjectValidation
kb-reference: Reference-GatheringEvidenceModel-DrivenSoftwareEngineeringinAutomatedDigitalForensics
d3fend-id: D3-FISV
kb-article: ## How it works File format specifications often define expected values for specific fields. A common example are file signatures, or magic numbers, which are used to quickly identify files. Another example is within the Compound Document Header of Microsoft Office files, the 29th and 30th byte identifies the byte order, specifically 0xFFFE for little-endian. This technique verifies that the file's static values match the values of the declared file format's specification.
definition: The process of checking specific static values within a file, such as file signatures or magic numbers, to ensure they match the expected values defined by the file format specification.

File Magic Byte Verification
type: Class
subclass of: File Metadata Value Verification
subclass of: Restriction
  on property: analyzes
  some values from: File Magic Bytes
type: NamedIndividual
analyzes: File Magic Bytes
kb-reference: Reference-CarvingContiguousandFragmentedFilesWithFastObjectValidation
kb-reference: Reference-GatheringEvidenceModel-DrivenSoftwareEngineeringinAutomatedDigitalForensics
d3fend-id: D3-FMBV
kb-article: ## How it works Many file formats use magic numbers to identify a file format or protocol. Verifying that the magic number matches the expected value of its declared format is a simple way of verifying the file format.
definition: Utilizing the magic number to verify the file

File Magic Bytes
type: Class
subclass of: File Header Block Signature
type: NamedIndividual
definition: A specific type of header signature located at the beginning of a file, used to identify the file format.

File Metadata
type: Class
subclass of: Metadata
type: NamedIndividual
definition: Information that describes and provides context about a file's content, structure, and attributes.

File Metadata Consistency Validation
type: Class
subclass of: File Format Verification
subclass of: Restriction
  on property: analyzes
  some values from: File Content Block Data
subclass of: Restriction
  on property: analyzes
  some values from: File Metadata
type: NamedIndividual
analyzes: File Content Block Data
analyzes: File Metadata
kb-reference: Reference-GatheringEvidenceModel-DrivenSoftwareEngineeringinAutomatedDigitalForensics
d3fend-id: D3-FMCV
kb-article: ## How it works This technique involves validating the consistency between a file's metadata and its actual content. It checks elements like declared lengths, pointers, and checksums to ensure they accurately describe the file's content. For instance, if a header specifies a content block of 50 bytes, this should be verified, and CRC values should be recalculated and compared.
definition: The process of validating the consistency between a file's metadata and its actual content, ensuring that elements like declared lengths, pointers, and checksums accurately describe the file's content.

File Metadata Value Verification
type: Class
subclass of: File Format Verification
subclass of: Restriction
  on property: analyzes
  some values from: File Footer Block
subclass of: Restriction
  on property: analyzes
  some values from: File Header Block
type: NamedIndividual
analyzes: File Footer Block
analyzes: File Header Block
kb-reference: Reference-CarvingContiguousandFragmentedFilesWithFastObjectValidation
kb-reference: Reference-IntroductoryComputerForensics
d3fend-id: D3-FMVV
description: ## How it works File format specifications often define expected values for specific fields. A common example are file signatures, or magic numbers, which are used to quickly identify files. Another example is within the Compound Document Header of Microsoft Office files, the 29th and 30th byte identifies the byte order, specifically 0xFFFE for little-endian. This technique verifies that the file's static values match the values of the declared file format's specification.
definition: The process of checking specific static values within a file, such as file signatures or magic numbers, to ensure they match the expected values defined by the file format specification.

File Mount Event
type: Class
subclass of: File Event
definition: An event where a file system or storage volume is mounted, making its files and directories accessible to the operating system or applications.

File Path Open Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: Restriction
  on property: invokes
  some values from: Open File
type: NamedIndividual
accesses: File
invokes: Open File
definition: Has an input of a file path, and opens a file handle for reading or writing.

File Renaming Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Access Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Creation Event
definition: An event representing the renaming of a file, modifying its identifier within the file system while retaining its content and metadata.

File Section
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
alternative label: File Part
definition: A file section is one of the portions of a file in which the file is regarded as divided and where together the file sections constitute the whole file.

File Server
type: Class
subclass of: Server
definition: The term server highlights the role of the machine in the traditional client-server scheme, where the clients are the workstations using the storage. A file server does not normally perform computational tasks or run programs on behalf of its client workstations. File servers are commonly found in schools and offices, where users use a local area network to connect their client computers.

File Set Attributes Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Access Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Creation Event
definition: An event where a file's metadata attributes are modified, such as changing its timestamps, labels, or categorization within the system.

File Set Permissions Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Creation Event
definition: An event involving the modification of a file's permissions or access control list (ACL), specifying which users or processes are granted or restricted access.

File Share Service
type: Class
subclass of: Network Service
definition: A file sharing service (or file share service) provides the ability to share data across a network.

File System
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Directory
subclass of: Restriction
  on property: contains
  some values from: File
subclass of: Restriction
  on property: contains
  some values from: File System Link
subclass of: Restriction
  on property: contains
  some values from: File System Metadata
type: NamedIndividual
contains: Directory
contains: File
contains: File System Link
contains: File System Metadata
definition: In computing, a file system or filesystem is used to control how data is stored and retrieved. Without a file system, information placed in a storage medium would be one large body of data with no way to tell where one piece of information stops and the next begins. By separating the data into pieces and giving each piece a name, the information is easily isolated and identified. Taking its name from the way paper-based information systems are named, each group of data is called a "file". The structure and logic rules used to manage the groups of information and their names is called a "file system".

File System Link
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A file system link associates a name with a file on a file system. Most generally, this may be a direct reference (a hard link) or an indirect one (a soft link).

File System Metadata
type: Class
subclass of: Metadata
type: NamedIndividual
definition: Metadata about the files and directories in a file system. For example file name, file length, time modified, group and user ids, and other file attributes.

File System Sensor
type: Class
subclass of: Endpoint Sensor
subclass of: Restriction
  on property: monitors
  some values from: File
type: NamedIndividual
monitors: File
definition: Collects files and file metadata on an endpoint.

File Transfer Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: File transfer network traffic is network traffic related to file transfers between network nodes. This includes only network traffic conforming to standard file transfer protocols, not custom transfer protocols.

File Unmount Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Mount Event
definition: An event where a file system or storage volume is unmounted, disconnecting its files and directories from the operating system or applications.

File Update Event
type: Class
subclass of: File Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Access Event
subclass of: Restriction
  on property: preceded-by
  some values from: File Creation Event
definition: An event involving changes to the content or metadata of an existing file, reflecting updates that alter its state or properties.

Finger Print Scanner Input Device
type: Class
subclass of: Image Scanner Input Device
definition: A fingerprint sensor is an electronic device used to capture a digital image of the fingerprint pattern. The captured image is called a live scan. This live scan is digitally processed to create a biometric template (a collection of extracted features) which is stored and used for matching. Many technologies have been used including optical, capacitive, RF, thermal, piezoresistive, ultrasonic, piezoelectric, and MEMS.
alternative label: Fingerprint Sensor

Firewall
type: Class
subclass of: Computer Network Node
subclass of: Restriction
  on property: filters
  some values from: Network Traffic
type: NamedIndividual
filters: Network Traffic
definition: In computing, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted internal network and untrusted external network, such as the Internet. Firewalls are often categorized as either network firewalls or host-based firewalls. Network firewalls filter traffic between two or more networks and run on network hardware. Host-based firewalls run on host computers and control network traffic in and out of those machines. This definition refers to network firewalls.
alternative label: Network Firewall

Firmware
type: Class
subclass of: Software
type: NamedIndividual
definition: In electronic systems and computing, firmware is a type of software that provides control, monitoring and data manipulation of engineered products and systems. Typical examples of devices containing firmware are embedded systems (such as traffic lights, consumer appliances, remote controls and digital watches), computers, computer peripherals, mobile phones, and digital cameras. The firmware contained in these devices provides the low-level control program for the device.

Firmware Behavior Analysis
type: Class
subclass of: Platform Monitoring
subclass of: Restriction
  on property: analyzes
  some values from: Firmware
type: NamedIndividual
analyzes: Firmware
kb-reference: Reference-FirmwareBehaviorAnalysisConFirm
kb-reference: Reference-FirmwareBehaviorAnalysisVIPER
d3fend-id: D3-FBA
kb-article: ## How it works Firmware behavior analysis provides protections by ensuring that installed firmware has not been tampered with or modified. Firmware analysis applies to mutable firmware and immutable read-only memory (ROMs). Firmware in deployed network devices is typically not analyzed and monitored for vulnerabilities and thus is subject to potential attacks. This technique makes use of known and measured behavioral attributes, including timing attributes, of analyzed firmware on deployed devices. A behavioral method that employs known timing measurements may use the timing results from a challenge and response protocol to detect the presence of malware in embedded firmware. Firmware device timing measurements are made, specific to the installed device, and are used in the verifying function. The original firmware image is modified by injecting a monitoring software component into the embedded firmware code. The injected software components will allow for a software root of trust, the challenge and response protocol, to be implement in the firmware. A challenge-response is issued and includes a nonce so that replays are not allowed. The firmware will calculate a checksum over all of memory, including the nonce, and return the result. The verification system will compare the computed checksum and the time it took for the computation of the checksum to determine if the firmware has been modified. ## Considerations * The firmware code will need to be modified to include the behavioral monitoring functionality. * This technique is sensitive to the device the embedded firmware is hosted on and it is expected that the devices and firmware will need to be profiled and analyzed to determine timing estimation. * This technique is not expected to be one hundred percent correct as you would expect in a hardware root of trust solution and may require some tuning.
definition: Analyzing the behavior of embedded code in firmware and looking for anomalous behavior and suspicious activity.
synonym: Firmware Timing Analysis

Firmware Embedded Monitoring Code
type: Class
subclass of: Platform Monitoring
subclass of: Restriction
  on property: analyzes
  some values from: Firmware
type: NamedIndividual
analyzes: Firmware
kb-reference: Reference-FirmwareEmbeddedMonitoringCodeRedBalloon
kb-reference: Reference-FirmwareEmbeddedMonitoringCodeSymbiotes
d3fend-id: D3-FEMC
definition: Monitoring code is injected into firmware for integrity monitoring of firmware and firmware data.
kb-article: ## How it works Firmware in deployed network devices is typically not monitored for malicious changes. This technique provides a method to embed a software security component into the deployed firmware which provides a near real-time monitoring hook. The exception handling code, in the firmware, is typically used to expose any detected vulnerabilities. The injected software components provide a feature similar to intrusion detection systems for the firmware by detecting unauthorized modifications of the embedded firmware. The integrity of static code and firmware data are monitored continuously in the hosted devices. Comparisons are made to monitored elements like firmware memory addresses and data segments. Memory pages are scanned and if a modification is detected the software component may lock the page. This will protect subsequent attempted modifications to the firmware. The software component may utilize the exception handling code and thus be able to disclose the exact address of the modified memory. The injected software components are inserted during the firmware imaging process. The injected software is assumed to have knowledge of both the embedded code and the current execution state of the host program. The injected software will monitor and alert, in near real-time, on potential suspicious activity. The injected code is run alongside of the embedded code in the host. The injected software operates as an independent entity and is not dependent on the host software. Finally, this technique may implement other countermeasure techniques as part of their analytical processes. These should be identified by referencing other countermeasure techniques directly as necessary. ## Considerations * The firmware code will need to be modified and re-hosted on the device. * Exposing monitoring hooks to the injected code may introduce additional risk.

Firmware Sensor
type: Class
subclass of: Endpoint Sensor
subclass of: Restriction
  on property: monitors
  some values from: Firmware
type: NamedIndividual
monitors: Firmware
definition: Collects information on firmware installed on an Endpoint.

Firmware Verification
type: Class
subclass of: Platform Monitoring
subclass of: Restriction
  on property: verifies
  some values from: Firmware
type: NamedIndividual
kb-reference: Reference-FirmwareVerificationEclypsium
kb-reference: Reference-FirmwareVerificationTrapezoid
kb-reference: Reference-PlatformFirmwareResiliencyGuidelines NIST
verifies: Firmware
d3fend-id: D3-FV
kb-article: ## How it works Cryptographic hash values are computed for system and peripheral firmware. The hash values are compared against precomputed hash values for the identified firmware. A hash value mismatch may indicate that the firmware may have been tampered with or updated with a non-current release indicating a misconfiguration for the system. ## Considerations * Requires cryptographically computed hash values of firmware * Requires storage of precomputed firmware hash values
definition: Cryptographically verifying firmware integrity.

First-order Logic
type: Class
subclass of: Predicate Logic
type: NamedIndividual
d3fend-id: D3A-FOL
synonym: First-order Predicate Calculus
synonym: FOL
synonym: Quantificational Logic
definition: First-order logic is a collection of formal systems used in mathematics, philosophy, linguistics, and computer science. First-order logic uses quantified variables over non-logical objects, and allows the use of sentences that contain variables.
kb-article: ## How it works For propositions such as "Socrates is a man", one can have expressions in the form "there exists x such that x is Socrates and x is a man", where "there exists" is a quantifier, while x is a variable. This distinguishes it from propositional logic, which does not use quantifiers or relations. The term "first-order" distinguishes first-order logic from higher-order logic, in which there are predicates having predicates or functions as arguments, or in which quantification over predicates, functions, or both, are permitted. ## Considerations - Advantages: -- First-order logic is more expressive than propositional logic; one can talk about objects and their properties, relations between objects. -- First-order logic is able to make use of variables and quantifiers (e.g., "for all" and "exists".) -- First-order logic supports power forms of reasoning, such as inferring the properties of an unknown object from the properties of known objects. - Disadvantages: -- First-order logic is more difficult to learn and use than propositional logic, due to its greater complexity. -- First-order logic is also less tractable than propositional logic in many cases; reasoning about quantifiers and variables adds complexity. -- First-order logic can be difficult to apply in practice, due to the need to find appropriate axioms and rules for each application. ### Verification Approach - Automated theorem provers can assist in formal verification, performing automated reasoning over system modeled in first-order logic and explore a complete space of system behaviors - First-order logic may be more expressive than necessary for many types of problems and may be more difficult to verify by SMEs. - Theorem provers based in FOL are capable of use in software verification tasks, but an SMT solver such as Z3 might be more appropriate. - Defining a set of competency questions (i.e., query use cases for a first-order logic ontology) can help scope the logic required for a complete…

First-stage Boot Loader
type: Class
subclass of: Boot Loader
definition: The very first routine run in order to load the operating system.

Flash Memory
type: Class
subclass of: Secondary Storage
definition: Flash memory is an electronic non-volatile computer memory storage medium that can be electrically erased and reprogrammed.

Forecasting
type: Class
subclass of: Analytical Purpose

Forward Proxy Server
type: Class
subclass of: Proxy Server
definition: An forward (or open) proxy is a proxy server that is accessible by any Internet user. Generally, a proxy server only allows users within a network group (i.e. a closed proxy) to store and forward Internet services such as DNS or web pages to reduce and control the bandwidth used by the group. With an open proxy, however, any user on the Internet is able to use this forwarding service.

Forward Resolution Domain Denylisting
type: Class
subclass of: DNS Denylisting
subclass of: Restriction
  on property: blocks
  some values from: Outbound Internet DNS Lookup Traffic
type: NamedIndividual
blocks: Outbound Internet DNS Lookup Traffic
kb-reference: Reference-UseDNSPolicyForApplyingFiltersOnDNSQueries
d3fend-id: D3-FRDDL
kb-article: ## How it works Policies are created that filter DNS queries using fully qualified domain name (FQDN) of record in the query. A DNS policy can be created for blocking DNS queries from FQDNs that have been identified as unauthorized. ## Considerations Continuous maintenance of unauthorized domain lists is needed to keep up to date as updates occur.
synonym: Forward Resolution Domain Blacklisting
definition: Blocking a lookup based on the query's domain name value.

Forward Resolution IP Denylisting
type: Class
subclass of: DNS Denylisting
subclass of: Restriction
  on property: blocks
  some values from: Inbound Internet DNS Response Traffic
type: NamedIndividual
blocks: Inbound Internet DNS Response Traffic
kb-reference: Reference-UseDNSPolicyForApplyingFiltersOnDNSQueries
d3fend-id: D3-FRIDL
definition: Blocking a DNS lookup's answer's IP address value.
kb-article: ## How it works This technique prevents a client from learning IP addresses deemed to be potentially malicious, which would have been delivered via forward resolution responses. Responses to forward resolution requests (that is, requests where a domain is sent and IP(s) are returned) are collected, and the IP address(es) included as a response are examined. If the IP address(es) are in a range included in the blacklist, then the response is dropped and not forwarded to the client. The DNS lookup can be blocked by either dropping the network traffic with an inline device, or modifying the value of the response sent by the DNS server. To transparently prevent client applications from hanging on a request, it is common practice to replace malicious values with addresses in the range 127.0.0.0/8 or the address of a honeypot maintained by the network administrators. ## Considerations * This technique does not prevent the client from contacting the blacklisted IP, only from learning about this IP address via a nameserver lookup request. * DNS Response traffic can be transmitted over many different protocols, which presents a challenge to implementing methods to extract all DNS answer IP address value(s). * DNS has historically used UDP port 53, with TCP port 53 instead used for responses over 512 bytes or after a lack of response over UDP. * Usage of new protocols to provide confidentiality for DNS traffic, such as DoH (DNS over HTTPS) and DoT (DNS over TLS), complicates collection of the IP address(es) in DNS responses. These protocols have often been enabled in browser settings transparently after a browser update, with DNS requests proxied over one of these cryptographic protocols through a specified host. * This technique must be implemented logically between the application that receives the response and the server which sent the response. * DNS responses sent in an encrypted manner, such as those using DoH or DoT, will require interception of the TLS connections in …
synonym: Forward Resolution IP Blacklisting

Free Memory
type: Class
subclass of: System Call
subclass of: Restriction
  on property: deletes
  some values from: Memory Block
type: NamedIndividual
deletes: Memory Block

Full Volume Snapshot
type: Class
subclass of: VolumeSnapshot
definition: A full volume snapshot is a point-in-time copy of the complete contents of a volume.

Fuzzy Logic
type: Class
subclass of: Symbolic AI
type: NamedIndividual
d3fend-id: D3A-FL
definition: Fuzzy logic is a form of many-valued logic in which the truth value of variables may be any real number between 0 and 1.
kb-article: ## How it works It is employed to handle the concept of partial truth, where the truth value may range between completely true and completely false.[1] By contrast, in Boolean logic, the truth values of variables may only be the integer values 0 or 1. ## References 1. Fuzzy logic. (2023, May 28). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Fuzzy_logic)

GPT
type: Class
subclass of: Transformer-basedLearning
type: NamedIndividual
d3fend-id: D3A-GPT
kb-article: ## References Generative pre-trained transformer. (n.d.). In Wikipedia. [Link](https://en.wikipedia.org/wiki/Generative_pre-trained_transformer)
synonym: Generative Pre-trained Transformer
definition: Generative pre-trained transformers (GPT) are a type of large language model (LLM) and a prominent framework for generative artificial intelligence.

Gated Recurrent Unit
type: Class
subclass of: Recurrent Neural Network
type: NamedIndividual
d3fend-id: D3A-GRU
kb-article: ## References Wikipedia. (2021, September 20). Gated Recurrent Unit. [Link](https://en.wikipedia.org/wiki/Gated_recurrent_unit)
definition: The GRU is like a long short-term memory (LSTM) with a forget gate, but has fewer parameters than LSTM, as it lacks an output gate. GRU's performance on certain tasks of polyphonic music modeling, speech signal modeling and natural language processing was found to be similar to that of LSTM

Media Generation
type: Class
subclass of: Analytical Purpose

Generative Adversarial Network
type: Class
subclass of: UnsupervisedLearning
type: NamedIndividual
d3fend-id: D3A-GAN
kb-article: ## References Brownlee, J. (2019). What Are Generative Adversarial Networks (GANs)? Machine Learning Mastery. [Link](https://machinelearningmastery.com/what-are-generative-adversarial-networks-gans/)
synonym: GAN
definition: Generative Adversarial Networks (GAN) are an approach to generative modeling using deep learning methods, such as convolutional neural networks.

Geometric Mean
type: Class
subclass of: Central Tendency
type: NamedIndividual
d3fend-id: D3A-GM
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
definition: The nth root of the product of the data values, where there are n of these. This measure is valid only for data that are measured absolutely on a strictly positive scale.

Get Open Sockets
type: Class
subclass of: System Call
subclass of: Restriction
  on property: enumerates
  some values from: Pipe
type: NamedIndividual
enumerates: Pipe

Get Open Windows
type: Class
subclass of: System Call
type: NamedIndividual

Get Running Processes
type: Class
subclass of: System Call
subclass of: Restriction
  on property: enumerates
  some values from: Process
type: NamedIndividual
enumerates: Process

Get Screen Capture
type: Class
subclass of: System Call
type: NamedIndividual

Get System Config Value
type: Class
subclass of: System Config System Call
subclass of: Restriction
  on property: reads
  some values from: System Configuration Database Record
type: NamedIndividual
reads: System Configuration Database Record

Get System Network Config Value
type: Class
subclass of: Get System Config Value
type: NamedIndividual

Get System Time
type: Class
subclass of: System Call
type: NamedIndividual
definition: A system call that gets the system time. For POSIX.1 systems, time() invokes a call to get the system time.

Get Thread Context
type: Class
subclass of: System Call
subclass of: Restriction
  on property: queries
  some values from: Thread
type: NamedIndividual
queries: Thread

Global User Account
type: Class
subclass of: Domain User Account
type: NamedIndividual
definition: A type of user account in Microsoft Windows (NT) that has a domain-wide scope.defines that user's access to a logical group of network objects (computers, users, devices) that share the same Active Directory databases; that is, a user's access to the domain.

Goal
type: Class
subclass of: D3FEND Core

Goodman and Kruskal's Gamma
type: Class
subclass of: Rank Correlation
type: NamedIndividual
d3fend-id: D3A-GAKG
kb-article: ## References 1. Wolfram Research. (2012). GoodmanKruskalGamma. Wolfram Language function. [Link](https://reference.wolfram.com/language/ref/GoodmanKruskalGamma.html) 1. Goodman and Kruskal's gamma. (2022, Nov 23). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Goodman_and_Kruskal%27s_gamma]
definition: Goodman-Kruskal $\\gamma$ is a measure of rank correlation between x and y and is given by $(n_c -n_d) / (n_c + n_d)$, where $n_c$ is the number of concordant pairs of the observations and $n_d$ is the number of discordant pairs.

Gradient-Boosted Decision Tree
type: Class
subclass of: CART
type: NamedIndividual
d3fend-id: D3A-GBDT
definition: A gradient-boosted decision tree is, as in other bagging and boosting methods, a method where the relatively 'weak' machine learning model (a decision tree) is used in an ensemble to form a 'strong' machine learning model.
kb-article: ## Reference 1. Google. (28 Sep 2023). Gradient Boosted Decision Trees. [Link](https://developers.google.com/machine-learning/decision-forests/intro-to-gbdt).

Graph-based Clustering
type: Class
subclass of: Cluster Analysis
type: NamedIndividual
d3fend-id: D3A-GBC
synonym: Connection-based Clustering
definition: Graph-based Clustering is a form of clustering where data is represented with graphs to identify clusters. We include Connection-based Clustering in this class.
kb-article: ## References 1. Jagota, A. (13 Dec 2020). Density-based and Graph-based Clustering. towardsdatascience.com. [Link](https://towardsdatascience.com/density-based-and-graph-based-clustering-a1f0d45ff5fb) 1. Connectivity-Based Clustering. Sarang, P. (2023) in Thinking Data Science. The Springer Series in Applied Machine Learning. Springer, Cham. [Link](https://doi.org/10.1007/978-3-031-02363-7_10).

Graph-based Semi-supervised Learning
type: Class
subclass of: Semi-supervised Transductive Learning
type: NamedIndividual
d3fend-id: D3A-GBSSL
definition: Graph-based Semi-Supervised Learning (GSSL) methods aim to classify unlabeled data by learning the graph structure and labeled data jointly.
kb-article: ## References Yang, S., Pan, L., & Cheng, J. (2021). Graph-based Semi-Supervised Learning Methods for Imbalanced Data Classification. [Link](https://www.sciencedirect.com/science/article/pii/S0031320321002132?viewFullText=true).

Graphical User Interface
type: Class
subclass of: UserInterface
type: NamedIndividual
definition: A graphical user interface (GUI) is a type of user interface that allows users to interact with electronic devices through graphical icons and visual indicators such as secondary notation, instead of text-based user interfaces, typed command labels or text navigation. GUIs were introduced in reaction to the perceived steep learning curve of command-line interfaces (CLIs), which require commands to be typed on a computer keyboard.
alternative label: GUI

Graphics Card Firmware
type: Class
subclass of: Peripheral Firmware
definition: Firmware that is installed on computer graphics card.
alternative label: Video Card Firmware

Graphics Processing Unit
type: Class
subclass of: Processor
definition: A Graphics Processing Unit (GPU) is a specialized processor designed to efficiently perform parallel computations, primarily for rendering graphics and visual data.
synonym: GPU

Grid-CNN
type: Class
subclass of: Convolutional Neural Network
type: NamedIndividual
d3fend-id: D3A-GC
kb-article: ## References Talukdar, P. (2020, June 10). Convolutional Neural Networks Explained. Towards Data Science. [Link](https://towardsdatascience.com/convolutional-neural-networks-explained-9cc5188c4939)
definition: A class of neural networks that specializes in processing data that has a grid-like topology, such as an image.

Grid-based Clustering
type: Class
subclass of: High-dimension Clustering
type: NamedIndividual
d3fend-id: D3A-GBC
kb-article: ## References TechVidvan. (n.d.). Clustering in Machine Learning Tutorial. [Link](https://techvidvan.com/tutorials/clustering-in-machine-learning/)
definition: Divides the entire data space into a finite number of cells reducing the complexity of the data and focuses on the cells rather than the data.

Group
type: Class
subclass of: D3FEND Core

Group Creation Event
type: Class
subclass of: Group Management Event
definition: An event where a new group is established within the system, defining an entity to manage users and permissions collectively.

Group Deletion Event
type: Class
subclass of: Group Management Event
subclass of: Restriction
  on property: preceded-by
  some values from: Group Creation Event
definition: An event where an existing group is permanently removed from the system, dissolving its associated memberships and privileges.

Group Management Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Access Control Group
definition: An event involving the creation, modification, or deletion of a group, or changes to its membership and privileges. Group management events facilitate the enforcement of role-based access control by organizing users and permissions into logical units for streamlined administration and policy enforcement.

Group Policy
type: Class
subclass of: Access Control Configuration
type: NamedIndividual
definition: Group Policy is a feature of the Microsoft Windows NT family of operating systems that controls the working environment of user accounts and computer accounts. Group Policy provides the centralized management and configuration of operating systems, applications, and users' settings in an Active Directory environment. A version of Group Policy called Local Group Policy ("LGPO" or "LocalGPO") also allows Group Policy Object management on standalone and non-domain computers.

Grouping
type: Class
subclass of: Summarizing

Guideline Reference
type: Class
subclass of: Policy Reference
pref-label: Guideline

HTML File
type: Class
subclass of: Document File
definition: A document file encoded in HTML.The HyperText Markup Language, or HTML is the standard markup language for documents designed to be displayed in a web browser. It can be assisted by technologies such as Cascading Style Sheets (CSS) and scripting languages such as JavaScript. Web browsers receive HTML documents from a web server or from local storage and render the documents into multimedia web pages. HTML describes the structure of a web page semantically and originally included cues for the appearance of the document.

HTTP CONNECT Event
type: Class
subclass of: HTTP Request Event
definition: An event where the HTTP CONNECT method is used to establish a tunnel to the server identified by the target resource.

HTTP DELETE Event
type: Class
subclass of: HTTP Request Event
definition: An event where the HTTP DELETE method is used to delete the specified resource.

HTTP Event
type: Class
subclass of: Application Layer Event
subclass of: TCP Event
subclass of: Restriction
  on property: has-participant
  some values from: WebNetworkTraffic
definition: An event involving the Hypertext Transfer Protocol (HTTP), which operates over TCP to transmit hypermedia documents.

HTTP GET Event
type: Class
subclass of: HTTP Request Event
definition: An event where the HTTP GET method is used to request a representation of the specified resource.

HTTP HEAD Event
type: Class
subclass of: HTTP Request Event
definition: An event where the HTTP HEAD method is used to request metadata about the specified resource without the response body.

HTTP OPTIONS Event
type: Class
subclass of: HTTP Request Event
definition: An event where the HTTP OPTIONS method is used to describe the communication options for the target resource.

HTTP POST Event
type: Class
subclass of: HTTP Request Event
definition: An event where the HTTP POST method is used to submit data to the specified resource, often causing a change in state or side effects on the server.

HTTP PUT Event
type: Class
subclass of: HTTP Request Event
definition: An event where the HTTP PUT method is used to replace all current representations of the target resource with the request payload.

HTTP Request Event
type: Class
subclass of: HTTP Event
definition: An event where an HTTP request is sent from a client to a server over an established TCP connection.

HTTP Response Event
type: Class
subclass of: HTTP Event
subclass of: Restriction
  on property: preceded-by
  some values from: HTTP Request Event
definition: An event where an HTTP response is sent from a server to a client over an established TCP connection.

HTTP TRACE Event
type: Class
subclass of: HTTP Request Event
definition: An event where the HTTP TRACE method is used to perform a message loop-back test along the path to the target resource.

Hard Disk Firmware
type: Class
subclass of: Peripheral Firmware
definition: Firmware that is installed on a hard disk device.
alternative label: Hard Drive Firmware

Hard Link
type: Class
subclass of: File System Link
definition: In computing, a hard link is a directory entry that associates a name with a file on a file system. All directory-based file systems must have at least one hard link giving the original name for each file. The term "hard link" is usually only used in file systems that allow more than one hard link for the same file. Multiple hard links -- that is, multiple directory entries to the same file -- are supported by POSIX-compliant and partially POSIX-compliant operating systems, such as Linux, Android, macOS, and also Windows NT4 and later Windows NT operating systems.

Harden
type: Class
subclass of: Defensive Tactic
type: NamedIndividual
type: Defensive Tactic
display-priority: 0
display-order: 0
definition: The harden tactic is used to increase the opportunity cost of computer network exploitation. Hardening differs from Detection in that it generally is conducted before a system is online and operational.

Hardening Event
type: Class
subclass of: Security Event
type: NamedIndividual
related: Harden
definition: An event involving actions to strengthen defenses, such as applying patches or implementing secure configurations, reducing attack surfaces, and increasing the difficulty of exploitation by adversaries.

Hardware-based Process Isolation
type: Class
subclass of: Execution Isolation
subclass of: Restriction
  on property: isolates
  some values from: Process
subclass of: Restriction
  on property: restricts
  some values from: Create Process
type: NamedIndividual
isolates: Process
kb-reference: Reference-VirtualizedProcessIsolation AdvancedMicroDevicesInc
kb-reference: Reference-ApproachesForSecuringAnInternetEndpointUsingFine-grainedOperatingSystemVirtualization Bromium,Inc.
kb-reference: Reference-IsolationOfApplicationsWithinAVirtualMachine Bromium,Inc.
restricts: Create Process
d3fend-id: D3-HBPI
kb-article: ## How it works Process isolation, in this context, is address space separation controlled by a security function that limits the communication between processes so that one process cannot directly modify the executing code of another process. For example with virtual address space: * Process A address space is different from process B address space, which prevents process A from writing to process B Hardware process isolation is commonly implemented through Direct Memory Access (DMA) which collaborates with a Memory Management Unit (MMU), or Input-Output Memory Management Unit (IOMMU). These hardware controls are deployed directly on processors to aid hosts or enclaves in process isolation. * DMA - Direct memory access allows memory access to occur independently of the program currently run by the microprocessor. DMA allows for I/O devices to directly read from and write to memory, or it can be used to efficiently copy blocks of memory. During DMA transfers, the microprocessor can execute an unrelated program. * MMU - A memory management unit acts as an access control and is responsible for performing the translation of virtual memory addresses to physical memory addresses. The MMU allocates each process its own virtual memory space. * IOMMU - An input-output memory management unit is used to allocate each I/O device its own virtual address space to the underlying physical addresses. IOMMU allows devices that do not support long memory addresses to address the entire memory space. ## Considerations * Private hosts may be vulnerable to DMA attack if they have a PCI or PCI Express port that connects attached devices directly to physical address space. ## Implementations: * Intel Virtualization Technology for Directed I/O (Intel VT-d) * Firecracker
synonym: Virtualization
definition: Preventing one process from writing to the memory space of another process through hardware based address manager implementations.

Hardware-based Write Protection
type: Class
subclass of: Platform Hardening
subclass of: Restriction
  on property: hardens
  some values from: Storage
type: NamedIndividual
hardens: Storage
kb-reference: Reference-WhatisHardwareWriteProtect
d3fend-id: D3-HBWP
definition: Physical methods of preventing data from being written to computer storage.

Hardware Component Inventory
type: Class
subclass of: Asset Inventory
subclass of: Restriction
  on property: inventories
  some values from: Hardware Device
type: NamedIndividual
inventories: Hardware Device
kb-reference: Reference-AdvancedDeviceMatchingSystem
d3fend-id: D3-HCI
synonym: Hardware Component Discovery
kb-article: ## How it works Administrators collect information on hardware devices such as peripherals, NICs, processors, and memory devices that are components of the computers in their architecture using a variety of administrative and management tools that query for this information. In some cases, where such queries are not supported or provide specific information of interest, an administrator may also collect this information through remote adminstration tools and system commands, either manually or using scripts. ## Considerations * Scanning and probing techniques using mapping tools can result in side effects to information technology (IT) and operational technology (OT) systems. * An adversary conducting network enumeration may engage in activities that parallel normal hardware inventorying activities, but would require escalating to admin privileges for most of the operations requiting administrative tools ## Examples * Bus discovery * Admin-scripted PCI Bus inventory using ssh and pciutils * Application-layer discovery * Simple Network Management Protocol (SNMP) collects MIB information * Web-based Enterprise Management (WBEM) collects CIM information * Windows Management Instrumentation (WMI) * Windows Management Infrastructure (MI)
synonym: Hardware Component Inventorying
definition: Hardware component inventorying identifies and records the hardware items in the organization's architecture.

Hardware Device
type: Class
subclass of: Digital Information Bearer
subclass of: Physical Artifact
type: NamedIndividual
definition: Hardware devices are the physical artifacts that constitute a network or computer system. Hardware devices are the physical parts or components of a computer, such as the monitor, keyboard, computer data storage, hard disk drive (HDD), graphic cards, sound cards, memory (RAM), motherboard, and so on, all of which are tangible physical objects. By contrast, software is instructions that can be stored and run by hardware. Hardware is directed by the software to execute any command or instruction. A combination of hardware and software forms a usable computing system.

Hardware Device Bind Event
type: Class
subclass of: Hardware Device State Event
definition: An event where a device is logically bound to a system or process, typically for exclusive use or integration with specific software components.

Hardware Device Connection Event
type: Class
subclass of: Hardware Device State Event
definition: An event representing the physical or logical attachment of a device to a system, enabling its operational functionality.

Hardware Device Disabled Event
type: Class
subclass of: Hardware Device State Event
subclass of: Restriction
  on property: preceded-by
  some values from: Hardware Device Enabled Event
definition: An event where a device transitions to an inactive or unavailable state, often due to deactivation, failure, or maintenance.

Hardware Device Disconnection Event
type: Class
subclass of: Hardware Device State Event
subclass of: Restriction
  on property: preceded-by
  some values from: Hardware Device Connection Event
definition: An event representing the removal of a device from a system, ceasing its operational functionality or availability.

Hardware Device Enabled Event
type: Class
subclass of: Hardware Device State Event
subclass of: Restriction
  on property: preceded-by
  some values from: Hardware Device Connection Event
definition: An event where a device becomes operational and available for use, typically following initialization, activation, or repair.

Hardware Device Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Hardware Device
definition: An event capturing the existence, state, or interaction of hardware or virtual devices within a system. Device events encompass activities such as discovery, connection, disconnection, operational state changes, or configuration modifications, providing visibility into device behavior and health.

Hardware Device Move Event
type: Class
subclass of: Hardware Device State Event
definition: An event where a device is relocated or reassigned within a system or network, potentially affecting its operational scope or connectivity.

Hardware Device State Event
type: Class
subclass of: Hardware Device Event
definition: An event involving a change to a device's state, such as connection, disconnection, modification, or operational state transitions (e.g., online or offline). Device state events provide visibility into device availability and operational conditions.

Hardware Device Unbind Event
type: Class
subclass of: Hardware Device State Event
subclass of: Restriction
  on property: preceded-by
  some values from: Hardware Device Bind Event
definition: An event where a device is logically unbound from a system or process, releasing it from exclusive use or integration.

Hardware Device Update Event
type: Class
subclass of: Hardware Device State Event
subclass of: Restriction
  on property: preceded-by
  some values from: Hardware Device Connection Event
definition: An event capturing updates or changes to a device's configuration, properties, or state, including firmware updates, reconfigurations, or optimizations.

Hardware Driver
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: drives
  some values from: Hardware Device
type: NamedIndividual
drives: Hardware Device
alternative label: Device Driver
definition: In computing, a device driver (commonly referred to simply as a driver) is a computer program that operates or controls a particular type of device that is attached to a computer. A driver provides a software interface to hardware devices, enabling operating systems and other computer programs to access hardware functions without needing to know precise details of the hardware being used. A driver communicates with the device through the computer bus or communications subsystem to which the hardware connects. When a calling program invokes a routine in the driver, the driver issues commands to the device. Once the device sends data back to the driver, the driver may invoke routines in the original calling program. Drivers are hardware dependent and operating-system-specific. They usually provide the interrupt handling required for any necessary asynchronous time-dependent hardware interface.

Harmonic Mean
type: Class
subclass of: Central Tendency
type: NamedIndividual
d3fend-id: D3A-HM
definition: The reciprocal of the arithmetic mean of the reciprocals of the data values. This measure too is valid only for data that are measured absolutely on a strictly positive scale.
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)

Heap Segment
type: Class
subclass of: Process Segment
definition: The heap segment (or free store) is a large pool of memory from which dynamic memory requests of a process are allocated and satisfied.

Heterogeneous Asymmetric Feature-based Transfer Learning
type: Class
subclass of: Heterogeneous Transfer Learning
type: NamedIndividual
d3fend-id: D3A-HAFBTL
kb-article: ## References Wang, Q., Mao, K. Z., Wang, B., & Guan, J. (2017). Big data clustering by hybrid optimization algorithm. Journal of Big Data, 4(1), 25. [Link](https://journalofbigdata.springeropen.com/articles/10.1186/s40537-017-0089-0).
definition: Asymmetric transformation mapping transforms the source feature space to align with that of the target or the target to that of the source. This, in effect, bridges the feature space gap and reduces the problem into a homogeneous transfer problem when further distribution differences need to be corrected.

Heterogeneous Feature-based Transfer Learning
type: Class
subclass of: Heterogeneous Transfer Learning
type: NamedIndividual
d3fend-id: D3A-HFBTL
definition: Symmetric transformation takes both the source feature space Xs and target feature space Xt and learns feature transformations as to project each onto a common subspace Xc for adaptation purposes. This derived subspace becomes a domain-invariant feature subspace to associate cross-domain data, and in effect, reduces marginal distribution differences.
kb-article: ## References Wang, Q., Mao, K. Z., Wang, B., & Guan, J. (2017). Big data clustering by hybrid optimization algorithm. Journal of Big Data, 4(1), 25. [Link](https://journalofbigdata.springeropen.com/articles/10.1186/s40537-017-0089-0).

Heterogeneous Transfer Learning
type: Class
subclass of: Transfer Learning
type: NamedIndividual
d3fend-id: D3A-HTL
definition: Heterogeneous transfer learning is characterized by the source and target domains having differing feature spaces, but may also be combined with other issues such as differing data distributions and label spaces.
kb-article: ## References Wang, Q., Mao, K. Z., Wang, B., & Guan, J. (2017). Big data clustering by hybrid optimization algorithm. Journal of Big Data, 4(1), 25. [Link](https://journalofbigdata.springeropen.com/articles/10.1186/s40537-017-0089-0).

Hierarchical Clustering
type: Class
subclass of: Cluster Analysis
type: NamedIndividual
d3fend-id: D3A-HC
definition: Hierarchical clustering (also called hierarchical cluster analysis or HCA) is a method of cluster analysis that seeks to build a hierarchy of clusters.
kb-article: ## References Wikipedia. (2021, August 10). Hierarchical clustering. [Link](https://en.wikipedia.org/wiki/Hierarchical_clustering) html)

Hierarchical Domain Denylisting
type: Class
subclass of: Forward Resolution Domain Denylisting
type: NamedIndividual
kb-reference: Reference-UseDNSPolicyForApplyingFiltersOnDNSQueries
d3fend-id: D3-HDDL
kb-article: ## How it works This technique is used to block DNS queries from related domains and subdomains that are unauthorized. Hierarchical domain blacklisting considers the blacklisting of second level domains and additional sub-domains and specific hosts for a given query value. A denylist is maintained that contains DNS names and corresponding subdomains, including wildcards, that should be blocked for a given lookup. ## Considerations * The denylist of domain names will have to be maintained and will need to be kept up to date * Other domains that resolve to the domain of interest for blocking (CNAME, etc). * Denylists should have identified maintenance cycles to ensure lists are not stale.
definition: Blocking the resolution of any subdomain of a specified domain name.
synonym: Hierarchical Domain Blacklisting

High-dimension Clustering
type: Class
subclass of: Cluster Analysis
type: NamedIndividual
d3fend-id: D3A-HDC
definition: The cluster analysis of data with anywhere from a few dozen to many thousands of dimensions.
kb-article: ## References Wikipedia. (n.d.). Clustering high-dimensional data. [Link](https://en.wikipedia.org/wiki/Clustering_high-dimensional_data)

Higher-order Logic
type: Class
subclass of: Predicate Logic
type: NamedIndividual
d3fend-id: D3A-HOL
synonym: HOL
kb-article: ## References 1. Higher-order logic. (2023, May 13). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Higher-order_logic)
definition: Higher-order logic is a form of predicate logic that is distinguished from first-order logic by additional quantifiers and, sometimes, stronger semantics. Higher-order logics with their standard semantics are more expressive, but their model-theoretic properties are less well-behaved than those of first-order logic.

Histogramming
type: Class
subclass of: Summarizing

Homogenous Transfer Learning
type: Class
subclass of: Transfer Learning
type: NamedIndividual
d3fend-id: D3A-HTL
definition: In homogeneous transfer learning, the feature spaces of the source and target domains is of the same dimension (Ds = Dt) while the data of both domains is represented by the same attributes (Xs = Xt) and labels (Ys = Yt). Thus, homogeneous transfer learning aims to bridge the gap in the data distributions experienced during cross-domain transfer.
kb-article: ## References Khalil, K., Asgher, U., & Ayaz, Y. (2022). Novel fNIRS study on homogeneous symmetric feature-based transfer learning for brain-computer interface. Scientific Reports, 12, 3198. [Link](https://www.nature.com/articles/s41598-022-06805-4).

Homoglyph Denylisting
type: Class
subclass of: Forward Resolution Domain Denylisting
type: NamedIndividual
kb-reference: Reference-DetectionOfMaliciousIDNHomoglyphDomains
d3fend-id: D3-HDL
definition: Blocking DNS queries that are deceptively similar to legitimate domain names.
kb-article: ## How it works Homoglyph domain blacklisting considers the domain and subdomain structure of a lookup and compares the named components to blacklisted named components. The blacklisted named components are typically crafted modifications of known good domains, e.g., gooogle.com versus google.com. The blacklisted domains typically resemble trusted domains, but have been altered slightly to deceive users. The blacklisted named components also include consideration for fonts or Unicode characters that can make certain characters appear very similar (zero vs capital O and the letter l vs the number one). The blacklisted domains under certain fonts will appear to be a trusted domain. ## Considerations * Maintaining the currency of the list can be a challenge especially with newly registered domain entries. * Blacklists should have identified maintenance cycles to ensure lists are not stale.
synonym: Homoglyph Blacklisting

Homoglyph Detection
type: Class
subclass of: Identifier Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Email
subclass of: Restriction
  on property: analyzes
  some values from: URL
type: NamedIndividual
analyzes: Email
analyzes: URL
kb-reference: Reference-Computer-implementedMethodsAndSystemsForIdentifyingVisuallySimilarTextCharacterStrings GreathornInc
kb-reference: Reference-SystemAndMethodForDetectingHomoglyphAttacksWithASiameseConvolutionalNeuralNetwork EndgameInc
d3fend-id: D3-HD
definition: Comparing strings using a variety of techniques to determine if a deceptive or malicious string is being presented to a user.
kb-article: ## How it works A homoglyph, in this context, is a deceptive string or word which looks like a trusted word, but is composed of different characters, for example: goooogle.com versus google.com. This is commonly found in phishing and typo squatting attacks where a human exploiting through a social engineering campaign. ## Considerations * In very large environments processing DNS queries can be computationally expensive due to the amount of traffic that is generated * Legitimate companies and products use non-dictionary words in their names that could result in many false positives

Host
type: Class
subclass of: Computer Network Node
subclass of: Restriction
  on property: contains
  some values from: Application
type: NamedIndividual
contains: Application
alternative label: Network Host
definition: A host is a computer or other device, typically connected to a computer network. A network host may offer information resources, services, and applications to users or other nodes on the network. A network host is a network node that is assigned a network layer host address. Network hosts that participate in applications that use the client-server model of computing, are classified as server or client systems. Network hosts may also function as nodes in peer-to-peer applications, in which all nodes share and consume resources in an equipotent manner.

Host-based Firewall
type: Class
subclass of: System Software
type: NamedIndividual
definition: A software firewall which controls network inbound and outbound network traffic to the host computer.

Host Configuration Sensor
type: Class
subclass of: Endpoint Sensor
subclass of: Restriction
  on property: monitors
  some values from: Application Configuration
subclass of: Restriction
  on property: monitors
  some values from: Operating System Configuration
type: NamedIndividual
monitors: Application Configuration
monitors: Operating System Configuration
definition: Collects the configuration data on an endpoint.

Host Group
type: Class
subclass of: Access Control Group
subclass of: Restriction
  on property: contains
  some values from: Host
type: NamedIndividual
contains: Host
definition: A collection of Hosts used to allow operations such as access control to be applied to the entire group.

Host Reboot
type: Class
subclass of: Host Shutdown
subclass of: Restriction
  on property: terminates
  some values from: Process
type: NamedIndividual
kb-reference: Reference-NearMemoryInMemoryDetectionofFilelessMalware
terminates: Process
d3fend-id: D3-HR
kb-article: ## How It Works Host reboot can either be initiated in the physical presence of the device using the power functions or remotely using the provided user interface or an installed EDR agent (with the available function). This process may allow for the removal of specific types of malware, such as fileless malware, and can also prevent further damage, for example, if the system is part of a botnet. ## Considerations - If the attacker has achieved persistence techniques, this technique may not be effective - Compromised systems may not respond to remote commands to shutdown or reboot, requiring physical intervention. - Shutting down a system will usually result in the memory losing its state which can be useful in forensic activities so this should be considered when deciding to shutdown. - Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
definition: Initiating a host's reboot sequence to terminate all running processes.

Host Shutdown
type: Class
subclass of: Process Eviction
subclass of: Restriction
  on property: terminates
  some values from: Process
type: NamedIndividual
type: Process Termination
kb-reference: Reference-NearMemoryInMemoryDetectionofFilelessMalware
terminates: Process
d3fend-id: D3-HS
kb-article: ## How It Works Host shutdown can either be initiated in the physical presence of the device using the power functions or remotely using the provided user interface or an installed EDR agent (with the available function). This process may allow for the removal of specific types of malware, such as fileless malware, and can also prevent further damage, for example, if the system is part of a botnet. ## Considerations - If the attacker has achieved persistence techniques, this technique may not be effective - Compromised systems may not respond to remote commands to shutdown or reboot, requiring physical intervention. - Shutting down a system will usually result in the memory losing its state which can be useful in forensic activities so this should be considered when deciding to shutdown. - Shutting down systems may disrupt access to computer resources for legitimate users.
definition: Initiating a host's shutdown sequence to terminate all running processes.

Hostname
type: Class
subclass of: Identifier
subclass of: Restriction
  on property: identifies
  some values from: Host
type: NamedIndividual
type: Domain Name
identifies: Host
definition: In computer networking, a hostname (archaically nodename) is a label that is assigned to a device connected to a computer network and that is used to identify the device in various forms of electronic communication, such as the World Wide Web. Hostnames may be simple names consisting of a single word or phrase, or they may be structured.
alternative label: Nodename

Human Input Device Firmware
type: Class
subclass of: Peripheral Firmware
definition: Firmware that is installed on an HCI device such as a mouse or keyboard.

Hybrid-based Transfer Learning
type: Class
subclass of: Homogenous Transfer Learning
type: NamedIndividual
d3fend-id: D3A-HBTL
kb-article: ## References Day, O., & Khoshgoftaar, T.M. (2017). A survey on heterogeneous transfer learning. Journal of Big Data, 4(1), 29. [Link](https://doi.org/10.1186/s40537-017-0089-0).
definition: This method creates an asymmetric mapping from the target to the source and takes into account bias issues of cross-domain correspondences.

Hypothesis Testing
type: Class
subclass of: Inferential Statistics
type: NamedIndividual
d3fend-id: D3A-HT
definition: A statistical hypothesis test is a method of statistical inference used to decide whether the data at hand sufficiently support a particular hypothesis. Hypothesis testing allows us to make probabilistic statements about population parameters.
kb-article: ## References Wikipedia. (n.d.). Statistical hypothesis testing. [Link](https://en.wikipedia.org/wiki/Statistical_hypothesis_testing)

ID3
type: Class
subclass of: Decision Tree
type: NamedIndividual
d3fend-id: D3A-ID3
definition: ID3 stands for Iterative Dichotomiser 3 and is named such because the algorithm iteratively (repeatedly) dichotomizes(divides) features into two or more groups at each step.
kb-article: ## Addtional Consiterations ID3 is the basis of C4.5, and is best used in natural language processing. ## References Decision Trees for Classification: ID3 Algorithm Explained. Towards Data Science. [Link](https://towardsdatascience.com/decision-trees-for-classification-id3-algorithm-explained-89df76e72df1).

I/O Module
type: Class
subclass of: Hardware Device
definition: An I/O Module is a hardware device that translates signals between external sensors or actuators and control systems. It typically handles analog-to-digital (and vice versa) conversion, serving as the data interface that allows physical processes to be monitored and controlled by digital controllers.

IO Port Restriction
type: Class
subclass of: Access Mediation
subclass of: Restriction
  on property: filters
  some values from: Input Device
subclass of: Restriction
  on property: filters
  some values from: Removable Media Device
type: NamedIndividual
filters: Input Device
filters: Removable Media Device
kb-reference: Reference-ComputerMotherboardHavingPeripheralSecurityFunctions
kb-reference: Reference-MethodAndSystemForControllingCommunicationPorts
kb-reference: Reference-USBFilterForHubMaliciousCodePreventionSystem
d3fend-id: D3-IOPR
kb-article: ## How It works Software-based restriction uses agent software installed on a computer system. The agent software monitors all IO port system traffic. The agent software is configurable to limit the use of certain devices connected to IO ports. The restriction software can also be configured to limit the access to files and applications on external storage devices connected to IO ports. Hardware-based restriction can also be employed to limit access to IO ports. For example, a hardware USB filter device that is placed between the host system and the external devices can filter IO port connections based on configurable rules. When new devices are connected to the USB filter the type of device is determined. Using an allow list a connection determination is made for the device. Some implementations detect when a device is connected in order to authorize the connection against a list of approved devices, in some cases by device type. For example, if the device is determined to be a storage device, then the contained files and executables are examined to more accurately identify the device type. Types of restrictions that may be applied: - Device connection - Device command filtering - Device file system read or write restrictions ## Considerations * Agent software will need to be installed on host systems * Configurations for allow/deny for devices and files will need to be maintained
definition: Limiting access to computer input/output (IO) ports to restrict unauthorized devices.

IP Address
type: Class
subclass of: Identifier
subclass of: Restriction
  on property: identifies
  some values from: Network Node
type: NamedIndividual
identifies: Network Node
definition: An Internet Protocol address (IP address) is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.An IP address serves two main functions: host or network interface identification and location addressing. Internet Protocol version 4 (IPv4) defines an IP address as a 32-bit number. However, because of the growth of the Internet and the depletion of available IPv4 addresses, a new version of IP (IPv6), using 128 bits for the IP address, was standardized in 1998. IPv6 deployment has been ongoing since the mid-2000s.

IPC Network Traffic
type: Class
subclass of: Network Traffic
definition: IPC network traffic is network traffic related to inter-process communication (IPC) between network nodes..This includes only network traffic conforming to a standard IPC protocol; not custom protocols.

IPC Traffic Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Intranet IPC Network Traffic
type: NamedIndividual
analyzes: Intranet IPC Network Traffic
kb-reference: Reference-SMBCopyAndExecution MITRE
kb-reference: Reference-SMBEventsMonitoring MITRE
kb-reference: Reference-SMBSessionSetups MITRE
kb-reference: Reference-SMBWriteRequest-NamedPipes MITRE
kb-reference: Reference-SMBWriteRequest MITRE
kb-reference: Reference-SecuritySystemWithMethodologyForInterprocessCommunicationControl CheckPointSoftwareTechInc
kb-reference: Reference-CAR-2015-04-001:RemotelyScheduledTasksViaAT MITRE
d3fend-id: D3-IPCTA
kb-article: ## How it works Inter process communication enables applications or threads to share data. This can involve one or more computers. Monitoring IPC in your environment can reveal abnormal or malicious activity. IPC can occur within a single computer or between multiple computers remotely through network protocols. Thus there are multiple ways to collect and monitor these exchanges between processes. A network protocol analyzer may monitor and parse SMB network traffic to record system activity. A host based monitoring agent may monitor IPC activity contained within a single host to look for deviations from standard usages. ### Examples * SMB * Zeromq * Java RMI API ## Considerations * IPC can generate substantial amounts of data, and it may not be feasible to collect all of it. * IPC may occur over loopback interfaces or direct memory access granted by the operating system.
definition: Analyzing standard inter process communication (IPC) protocols to detect deviations from normal protocol activity.
synonym: IPC Analysis

IP Phone
type: Class
subclass of: Personal Computer
definition: A VoIP phone or IP phone uses voice over IP technologies for placing and transmitting telephone calls over an IP network, such as the Internet, instead of the traditional public switched telephone network (PSTN). Digital IP-based telephone service uses control protocols such as the Session Initiation Protocol (SIP), Skinny Client Control Protocol (SCCP) or various other proprietary protocols.
alternative label: VoIP Phone

IP Reputation Analysis
type: Class
subclass of: Identifier Reputation Analysis
subclass of: Restriction
  on property: analyzes
  some values from: IP Address
type: NamedIndividual
analyzes: IP Address
kb-reference: Reference-Database for receiving storing and compiling information about email messages
kb-reference: Reference-Finding phishing sites
d3fend-id: D3-IPRA
definition: Analyzing the reputation of an IP address.

Identifier
type: Class
subclass of: Digital Information
subclass of: Restriction
  on property: identifies
  some values from: Artifact
type: NamedIndividual
identifies: Artifact
definition: An identifier is a name that identifies (that is, labels the identity of) either a unique object or a unique class of objects, where the "object" or class may be an idea, physical [countable] object (or class thereof), or physical [noncountable] substance (or class thereof). The abbreviation ID often refers to identity, identification (the process of identifying), or an identifier (that is, an instance of identification). An identifier may be a word, number, letter, symbol, or any combination of those.
alternative label: ID

Identifier Activity Analysis
type: Class
subclass of: Identifier Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Identifier
type: NamedIndividual
analyzes: Identifier
kb-reference: Reference-ThePyramidOfPain-DavidBianco
d3fend-id: D3-IAA
kb-article: ## How it works Identifier activity analysis is the process of taking identifiers--typically known malicious identifiers--and determining the artifacts that have interacted with those identifiers. There are many open and closed source repositories of identifiers that represent indicators of compromise. For example, VirusTotal contains hash signatures of malware and IP Addresses used by threat actors. Defenders can search for these indicators of compromise their own systems to gain context on activity around an identifier. ## Considerations Indicator activity analysis is a good way to gain high precision analysis, but adversaries can modify their own signatures such as hashes quickly to evade detection. This is related to David Bianco’s Pyramid of Pain - Indicators on the lower level (hash values, IP addresses domain names) are easy for adversaries to change. Identifier activity data of interest for analysis with the identifier might include, but is not limited to: * network traffic activity where the identifier was used to identify communicating entities or referred to in the communication * process activity referencing the identifier, especially for resource access * file activity referencing the identifier * registry settings referencing the identifier
definition: Taking known malicious identifiers and determining if they are present in a system.

Identifier Analysis
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Detect
type: NamedIndividual
enables: Detect
d3fend-id: D3-ID
definition: Analyzing identifier artifacts such as IP address, domain names, or URL(I)s.

Identifier Reputation Analysis
type: Class
subclass of: Identifier Analysis
type: NamedIndividual
kb-reference: Reference-Finding phishing sites
d3fend-id: D3-IRA
definition: Analyzing the reputation of an identifier.

Image-to-Image Translation GAN
type: Class
subclass of: Generative Adversarial Network
type: NamedIndividual
d3fend-id: D3A-ITITG
kb-article: ## References MathWorks. (n.d.). Get Started with GANs for Image-to-Image Translation. [Link](https://www.mathworks.com/help/images/get-started-with-gans-for-image-to-image-translation.html)
definition: Image-to-image translation is the task of transferring styles and characteristics from one image domain to another.

Image Code Segment
type: Class
subclass of: Image Segment
subclass of: Restriction
  on property: contains
  some values from: Subroutine
type: NamedIndividual
contains: Subroutine
definition: An image code segment, also known as a text segment or simply as text, is a portion of an object file that contains executable instructions. The term "segment" comes from the memory segment, which is a historical approach to memory management that has been succeeded by paging. When a program is stored in an object file, the code segment is a part of this file; when the loader places a program into memory so that it may be executed, various memory regions are allocated (in particular, as pages), corresponding to both the segments in the object files and to segments only needed at run time. For example, the code segment of an object file is loaded into a corresponding code segment in memory.

Image Data Segment
type: Class
subclass of: Image Segment
type: NamedIndividual
definition: An image data segment (often denoted .data) is a portion of an object file that contains initialized static variables, that is, global variables and static local variables. The size of this segment is determined by the size of the values in the program's source code, and does not change at run time. This segmenting of the memory space into discrete blocks with specific tasks carried over into the programming languages of the day and the concept is still widely in use within modern programming languages.

Image File
type: Class
subclass of: File
type: NamedIndividual
definition: A file that contains graphics data.

Image Scanner Input Device
type: Class
subclass of: VideoInputDevice
definition: An image scanner -- often abbreviated to just scanner, is a device that optically scans images, printed text, handwriting or an object and converts it to a digital image. Commonly used in offices are variations of the desktop flatbed scanner where the document is placed on a glass window for scanning. Hand-held scanners, where the device is moved by hand, have evolved from text scanning "wands" to 3D scanners used for industrial design, reverse engineering, test and measurement, orthotics, gaming and other applications. Mechanically driven scanners that move the document are typically used for large-format documents, where a flatbed design would be impractical.
alternative label: Scanner

Image Segment
type: Class
subclass of: Binary Segment
subclass of: File Section
definition: Image segments are distinct partitions of an object file. Both data and code segments are examples of image segments.

Image Synthesis GAN
type: Class
subclass of: Generative Adversarial Network
type: NamedIndividual
d3fend-id: D3A-ISG
kb-article: ## References Zhang, Q., Wang, H., Lu, H., Won, D., & Yoon, S. W. (2018). Medical Image Synthesis with Generative Adversarial Networks for Tissue Recognition. 2018 IEEE International Conference on Healthcare Informatics (ICHI), 199-207. doi: 10.1109/ICHI.2018.00030. [Link](https://ieeexplore.ieee.org/document/8419363)
definition: Image synthesis thorugh the application of Generative Adversarial Networks.

Impact Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Impact
type: NamedIndividual
enables: Impact

Impersonate User
type: Class
subclass of: System Call
subclass of: Restriction
  on property: forges
  some values from: UserAccount
type: NamedIndividual
type: System Call
forges: UserAccount

Import Library Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: loads
  some values from: Shared Library File
type: NamedIndividual
loads: Shared Library File
definition: Loads an external software library to enable the invocations of its methods.

In-memory Password Store
type: Class
subclass of: Password Store
type: NamedIndividual
definition: A password store held in memory.

Inbound Internet DNS Response Traffic
type: Class
subclass of: Inbound Internet Network Traffic
type: NamedIndividual
definition: Inbound internet DNS response traffic is DNS response traffic from a host outside a given network initiated on an incoming connection to a host inside that network.

Inbound Internet Encrypted Traffic
type: Class
subclass of: Inbound Internet Network Traffic
definition: Inbound internet encrypted traffic is encrypted network traffic on an incoming connection initiated from a host outside the network to a host within a network .

Inbound Internet Encrypted Web Traffic
type: Class
subclass of: Inbound Internet Encrypted Traffic
subclass of: Inbound Internet Web Traffic
definition: Inbound internet web traffic is network traffic that is: (a) on an incoming connection initiated from a host outside the network to a host within a network, and (b) using a standard web encryption protocol.

Inbound Internet Mail Traffic
type: Class
subclass of: Inbound Internet Network Traffic
subclass of: Inbound Network Traffic
subclass of: Mail Network Traffic
type: NamedIndividual
definition: Inbound internet mail traffic is network traffic that is: (a) coming from a host outside a given network via an incoming connection to a host inside that same network, and (b) using a standard protocol for email.

Inbound Internet Network Traffic
type: Class
subclass of: Inbound Network Traffic
subclass of: Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
type: NamedIndividual
produces: Network Traffic
definition: Inbound internet traffic is network traffic from a host outside a given network initiated on an incoming connection to a host inside that network.

Inbound Internet Web Traffic
type: Class
subclass of: Inbound Internet Network Traffic
definition: Inbound internet web traffic is network traffic that is: (a) on an incoming connection initiated from a host outside the network to a host within a network, and (b) using a standard web protocol.

Inbound Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: Inbound traffic is network traffic originating from another host (client), to the host of interest (server).

Inbound Session Volume Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Inbound Internet Network Traffic
type: NamedIndividual
analyzes: Inbound Internet Network Traffic
kb-reference: Reference-DetectingDDoSAttackUsingSnort
kb-reference: Reference-IdentifyingADenial-of-serviceAttackInACloud-basedProxyService-CloudfareInc.
kb-reference: Reference-MethodAndSystemForUDPFloodAttackDetection-RioreyLLC
kb-reference: Reference-ProtectingAgainstDistributedDenialOfServiceAttacks-CiscoTechnologyInc.
kb-reference: Reference-ProtectingAgainstDistributedNetworkFloodAttacks-JuniperNetworksInc.
d3fend-id: D3-ISVA
kb-article: ## How it works Network appliances are configured to alert on certain packets that typically are involved in DoS attacks. Typical packets include ICMP packets and SYN requests that are commonly used to flood networks. A sampling period is used to define a time window in which collected counts of the identified packets can be measured. If the collected number of packets exceeds a predefined limit then an alert is generated. ## Considerations Scalability as volume of attacks increase; single servers may not have the memory and storage resources to handle high volumes of network traffic.
definition: Analyzing inbound network session or connection attempt volume.

Inbound Traffic Filtering
type: Class
subclass of: Network Traffic Filtering
subclass of: Restriction
  on property: filters
  some values from: Inbound Network Traffic
type: NamedIndividual
filters: Inbound Network Traffic
kb-reference: Reference-ActiveFirewallSystemAndMethodology McAfeeLLC
kb-reference: Reference-AutomaticallyGeneratingRulesForConnectionSecurity Microsoft
kb-reference: Reference-FWTK-FirewallToolkit
kb-reference: Reference-FirewallForInterentAccess SecureComputingLLC
kb-reference: Reference-FirewallForProcessingAConnectionlessNetworkPacket NationalSecurityAgency
kb-reference: Reference-FirewallForProcessingConnection-orientedAndConnectionlessDatagramsOverAConnection-orientedNetwork NationalSecurityAgency
kb-reference: Reference-FirewallsThatFilterBasedUponProtocolCommands IntelCorp
kb-reference: Reference-MethodForControllingComputerNetworkSecurity CheckpointSoftwareTechnologiesLtd
kb-reference: Reference-NetworkFirewallWithProxy SecureComputingLLC
d3fend-id: D3-ITF
kb-article: ## How it works Inbound Traffic, in this context, is network traffic originating from an untrusted network towards a private host or enclave. For example: * An untrusted network host connecting to a internal commercial portal, shopping.example.com * An external mail server connecting to an internal mail server, mail.example.com Filtering policies are developed by administrators to meet business requirements and limit connectivity. These policies are implemented on edge devices such as firewalls, routers, and intrusion prevention systems. Examples of filters: * Blocking incoming traffic from spoofed internally facing IP addresses * Blocking specific ports and services from establishing connections * Limiting specific IP ranges from connecting to the network * Dynamic inbound filtering (Hole punching, STUN, NAT-T) ## Considerations * Business requirements typically drive the development of filtering rulesets * Protocols using non-standard ports may circumvent filtering technology, which does not detect application protocol based on traffic content ## Implementations * OpenWRT (Embedded) * Netfilter (Linux) * Windows Firewall * pf(BSD)
definition: Restricting network traffic originating from untrusted networks destined towards a private host or enclave.

Indirect Branch Call Analysis
type: Class
subclass of: Process Analysis
type: NamedIndividual
kb-reference: Reference-IndirectBranchingCalls
d3fend-id: D3-IBCA
kb-article: ## How it works This technique is used to detect an attacker attempting to exploit and execute code on a target system's call stack using return-oriented programming (ROP). Modern processors that have the ability to maintain a list of the branching calls, e.g., Intel's Last Branch Recording (LBR), can be used to track and analyze indirect branching calls that are indicative of malicious activity. In order to reduce the number of indirect branch calls to analyze to a manageable set it is assumed that malicious ROP activity will involve the use of system calls. The technique observes indirect branch calls that are part of paths that lead to system calls, all others are ignored. Branching calls chained together is often referred to as gadgets and gadgets are often used in ROP attacks. Indirect branch calls that involve a transfer from user-space to kernel-space are of interest for this technique. Identification of potential ROP exploit execution includes: - Inspecting the LBR when a system function call is made - The LBR is configured to return only instruction of interest (ret, indirect jmp, indirect calls) - Behavior is analyzed for - Ret instructions that appear to target areas not preceded by the call sites - Sequences of small code fragments that appear to be chained through the indirect branching calls (gadgets) - Of interest are returns that appear to not render control back after calls - Typical ret-call are paired - gadgets will appear to have ret followed by instruction of next instruction of the following gadget ## Considerations * May be operating system dependent since specific system calls are used to scope branching behavoir * Processors need to support access to a Last Branch Recording list feature * The size of the LBR stack can limit the expected size of the analyzed execution stack * If processor does not support LBR then overhead costs for the analysis can be significant
definition: Analyzing vendor specific branch call recording in order to detect ROP style attacks.

Inferential Statistics
type: Class
subclass of: Statistical Method
type: NamedIndividual
d3fend-id: D3A-IS
definition: Statistical inference is the process of using data analysis to infer properties of an underlying distribution of probability.
kb-article: ## References Wikipedia. (n.d.). Statistical inference. [Link](https://en.wikipedia.org/wiki/Statistical_inference)

Init Script
type: Class
subclass of: Executable Script
definition: An init script (or initialization script) is an executable script that initializes the an application, a process, or a service's state. Examples include scripts run at boot by Unix or Windows, or those run to initialize a shell.
alternative label: Initialization Script

Initial Access Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Initial Access
type: NamedIndividual
enables: Initial Access

Input Device
type: Class
subclass of: Hardware Device
subclass of: Local Resource
type: NamedIndividual
definition: In computing, an input device is a piece of equipment used to provide data and control signals to an information processing system such as a computer or information appliance. Examples of input devices include keyboards, mouse, scanners, digital cameras, joysticks, and microphones. Input devices can be categorized based on:

Input Device Analysis
type: Class
subclass of: Operating System Monitoring
subclass of: Restriction
  on property: analyzes
  some values from: Input Device
type: NamedIndividual
analyzes: Input Device
kb-reference: Reference-www.biometric-solutions.com keystroke-dynamics
kb-reference: Reference-ContinuousAuthenticationByAnalysisOfKeyboardTypingCharacteristics BradfordUniv.,UK
d3fend-id: D3-IDA
kb-article: ## How it works Input Device Hardening techniques filter certain commands, or disable related operating system functionality. ### Analytics All of these values can be analyzed and compared to a baseline: * Amount of input * Duration of a single input * Durations between inputs * Value of input Context can also include: * User which is logged in, to include attributes such as physical location of the user * Date and time * System which is processing the input * Source device of input, to include its properties (eg. manufacturer), configuration (eg. keyboard layout) and behavioral attributes of this device (eg. first use) * Source system of input (local or remote system) * Other hardware devices attached to the system ### Actions Actions can include: * Disabling the source device * Sending an alert * Locking the current session (eg. system screen lock, or returning to an authentication screen in a web app) and requiring one or more methods of authentication to continue * Administratively disabling credentials for the account or the entire account -- the technique *Account Locking* ### Examples A malicious input device sends many keystrokes with approximately the same delay between each. This does not match the normal cadence of input, and the device is disabled. Input to type the session user's name takes abnormally longer for each keystroke. The system is locked to the password prompt screen. A system receives key press events from two different devices -- one device sends keystrokes after the other has been idle for a long time. A system receives physical input in a user session, while that user has sent input from a device located out of the country in the past hour. Network traffic is suddenly routed through a new external device, and nearly the same volume of network traffic is subsequently sent out the previously existing interface. The new external device is disabled, and an alert is raised to investigate the network configuration for a potential compromise. ##…
definition: Operating system level mechanisms to prevent abusive input device exploitation.

Input Device Event
type: Class
subclass of: Hardware Device Event
subclass of: Restriction
  on property: has-participant
  some values from: Input Device
definition: An event involving human-machine interface devices, such as keyboards, mice, or touchscreens.

Input Function
type: Class
subclass of: Subroutine
definition: Generic function that receives input from an untrusted source.

Instance-based Transfer Learning
type: Class
subclass of: Homogenous Transfer Learning
type: NamedIndividual
d3fend-id: D3A-IBTL
kb-article: ## References Georgian Impact Blog. (n.d.). Transfer Learning Part 1. [Link](https://medium.com/georgian-impact-blog/transfer-learning-part-1-ed0c174ad6e7#:~:text=Homogeneous%20Transfer%20Learning-,1.,the%20target%20domain%20for%20training).
definition: Instance-based transfer learning methods try to reweight the samples in the source domain in an attempt to correct for marginal distribution differences. These reweighted instances are then directly used in the target domain for training.

Instant Messaging Client
type: Class
subclass of: Collaborative Software
definition: Client software used to engage in Instant Messaging, a type of online chat that offers real-time text transmission over the Internet. A LAN messenger operates in a similar way over a local area network. Short messages are typically transmitted between two parties, when each user chooses to complete a thought and select "send". Some IM applications can use push technology to provide real-time text, which transmits messages character by character, as they are composed. More advanced instant messaging can add file transfer, clickable hyperlinks, Voice over IP, or video chat.

Integer Range Validation
type: Class
subclass of: Source Code Hardening
subclass of: Restriction
  on property: hardens
  some values from: Mathematical Function
type: NamedIndividual
hardens: Mathematical Function
kb-reference: Reference-IntegerRangeValidation SEI
d3fend-id: D3-IRV
kb-article: ## How it Works Integer Range Validation can be done by programmatically checking the value of an integer before or after an operation to determine if the resulting value will be valid. Checking the value of an integer to ensure it is in a valid range helps prevent integer overflow, wraparound, and logical errors. ## Considerations * A valid range can be defined by language, data-type, or logical constraints. * Take extra care when doing operations on integers that will result in a value close to the bounds of a valid range. * Note: This resource should not be considered a definitive or exhaustive coding guideline.
definition: Ensuring that an integer is within a valid range.

Integrated Honeynet
type: Class
subclass of: Decoy Environment
subclass of: Restriction
  on property: spoofs
  some values from: Intranet Network
type: NamedIndividual
kb-reference: Reference-SynchronizingAHoneyNetworkConfigurationToReflectATargetNetworkEnvironment PaloAltoNetworksInc
spoofs: Intranet Network
d3fend-id: D3-IHN
kb-article: ## How it works Integrated honeynets use full production environments connected to the enterprise network, that utilize computing resources or software that attract attackers, and allow full interaction and access that provides a complete view of an attack. ## Considerations An attacker with control of a system on an Integrated Honeynet could: * try to attack other connected hosts on the network, its IP range of internal hosts not properly configured to react to connections from machines on the integrated honeynet, or position behind the firewall. * exploit its position by eavesdropping on network traffic If an attacker manages to stop the processes used to log an attack without setting off any alarms. [1] 1. Honeypots for Windows, Roger Grimes, 2005
definition: The practice of setting decoys in a production environment to entice interaction from attackers.

Integration Test Execution Tool
type: Class
subclass of: Test Execution Tool
definition: An integration test execution tool automatically performs integration testing. Integration testing (sometimes called integration and testing, abbreviated I&T) is the phase in software testing in which individual software modules are combined and tested as a group.

Internet Article Reference
type: Class
subclass of: Technique Reference
pref-label: Internet Article
alternative label: Internet Blog Reference

Internet-based Attacker
type: Class
subclass of: Remote Attacker
subclass of: Restriction
  on property: accesses
  some values from: WideAreaNetwork
definition: A remote attacker who leverages the internet to conduct attacks, such as through phishing, malware, or direct network attacks.

Internet DNS Lookup
type: Class
subclass of: DNS Lookup
definition: An internet Domain Name System (DNS) lookup is a DNS lookup made from a host on a network that is resolved after querying a DNS name server hosted on a different network.

Internet File Transfer Traffic
type: Class
subclass of: File Transfer Network Traffic
subclass of: Internet Network Traffic
definition: Internet file transfer network traffic is network traffic related to file transfers between network nodes that crosses a boundary between networks. This includes only network traffic conforming to standard file transfer protocols, not custom transfer protocols.

Internet Network
type: Class
subclass of: Network
definition: A network of multiple, connected networks. Internetworking is the practice of connecting a computer network with other networks through the use of gateways that provide a common method of routing information packets between the networks. The resulting system of interconnected networks are called an internetwork, or simply an internet. Internetworking is a combination of the words inter ("between") and networking; not internet-working or international-network.
alternative label: Interconnected Network
alternative label: Internet
alternative label: Internetwork

Internet Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: Internet network traffic is network traffic that crosses a boundary between networks. [This is the general sense of inter-networking; It may or may not cross to or from the Internet]

Internet Persona
type: Class
subclass of: Digital Information Bearer
definition: A social identity that an Internet user establishes in online communities and websites. It may also be an actively constructed presentation of oneself.
alternative label: Online Identity
alternative label: Online Persona
alternative label: Online Personality

Interprocess Communication
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: In computer science, inter-process communication or inter-process communication (IPC) refers specifically to the mechanisms an operating system provides to allow processes it manages to share data. Typically, applications can use IPC categorized as clients and servers, where the client requests data and the server responds to client requests. Many applications are both clients and servers, as commonly seen in distributed computing. Methods for achieving IPC are divided into categories which vary based on software requirements, such as performance and modularity requirements, and system circumstances, such as network bandwidth and latency.

Interquartile Range
type: Class
subclass of: Variability
type: NamedIndividual
d3fend-id: D3A-IR
definition: The interquartile range (IQR) is a measure of statistical dispersion, which is the spread of the data and is defined as the difference between the 75th and 25th percentiles of the data.
synonym: IQR
kb-article: ## References Wikipedia. (n.d.). Interquartile range. [Link](https://en.wikipedia.org/wiki/Interquartile_range)

Interval Estimation
type: Class
subclass of: Estimation
type: NamedIndividual
d3fend-id: D3A-IE
kb-article: ## References Wikipedia. (n.d.). Interval estimation. [Link](https://en.wikipedia.org/wiki/Interval_estimation)
definition: Interval estimation is the use of sample data to estimate an interval of possible values of a parameter of interest.

Intranet Administrative Network Traffic
type: Class
subclass of: Administrative Network Traffic
subclass of: Intranet Network Traffic
type: NamedIndividual
definition: Intranet administrative network traffic is administrative network traffic that does not cross a given network's boundaries and uses a standard administrative protocol.

Intranet DNS Lookup
type: Class
subclass of: DNS Lookup
definition: An Intranet Domain Name System (DNS) lookup is a DNS lookup made from a host on a network that is resolved after querying a DNS name server hosted on a that same network.

Intranet File Transfer Traffic
type: Class
subclass of: File Transfer Network Traffic
subclass of: Intranet Network Traffic
type: NamedIndividual
definition: Intranet file transfer traffic is file transfer traffic that does not cross a given network's boundaries and uses a standard file transfer protocol.

Intranet IPC Network Traffic
type: Class
subclass of: IPC Network Traffic
subclass of: Intranet Network Traffic
subclass of: Restriction
  on property: may-contain
  some values from: File
type: NamedIndividual
may-contain: File
definition: Intranet IPC network traffic is network traffic that does not cross a given network's boundaries and uses a standard inter-process communication (IPC) networking protocol.

Intranet Multicast Network Traffic
type: Class
subclass of: Intranet Network Traffic
type: NamedIndividual
definition: Intranet IPC network traffic is multicast network traffic that does not cross a given network's boundaries.

Intranet Network
type: Class
subclass of: Network
type: NamedIndividual
definition: An intranet is a private network accessible only to an organization's staff or delegates. Generally a wide range of information and services from the organization's internal IT systems are available that would not be available to the public from the Internet. A company-wide intranet can constitute an important focal point of internal communication and collaboration, and provide a single starting point to access internal and external resources. In its simplest form an intranet is established with the technologies for local area networks (LANs) and wide area networks (WANs).

Intranet Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: Intranet network traffic is network traffic traversing that does not traverse a given network's boundaries.

Intranet RPC Network Traffic
type: Class
subclass of: Intranet Network Traffic
subclass of: RPC Network Traffic
definition: Intranet RPC network traffic is network traffic that does not cross a given network's boundaries and uses a standard remote procedure call (e.g., RFC 1050) protocol.

Intranet Web Network Traffic
type: Class
subclass of: Intranet Network Traffic
subclass of: WebNetworkTraffic
subclass of: Restriction
  on property: may-contain
  some values from: File
type: NamedIndividual
may-contain: File
definition: Intranet web network traffic is network traffic that does not cross a given network's boundaries and uses a standard web protocol.

Intrinsically Semi-supervised Learning
type: Class
subclass of: Semi-Supervised Learning
type: NamedIndividual
d3fend-id: D3A-ISSL
kb-article: ## References Beginner's Guide to Semi-Supervised Learning. Jashish Blog. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/).
definition: These methods directly optimize an objective function with components for labeled and unlabeled samples and do not rely on any intermediate steps or supervised base learners. Basically, these methods are extension of existing supervised methods to include the effect of unlabeled data samples in the objective function.

Intrusion Detection System
type: Class
subclass of: Digital Information Bearer
definition: An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms.
alternative label: IDS

Intrusion Prevention System
type: Class
subclass of: Intrusion Detection System
definition: Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, report it and attempt to block or stop it. Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to actively prevent or block intrusions that are detected. IPS can take such actions as sending an alarm, dropping detected malicious packets, resetting a connection or blocking traffic from the offending IP address. An IPS also can correct cyclic redundancy check (CRC) errors, defragment packet streams, mitigate TCP sequencing issues, and clean up unwanted transport and network layer options.
alternative label: IDPS
alternative label: IPS
alternative label: Intrusion Detection and Prevention System

Isolate
type: Class
subclass of: Defensive Tactic
type: NamedIndividual
type: Defensive Tactic
definition: The isolate tactic creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses.
display-order: 2
display-priority: 0

Isolation Event
type: Class
subclass of: Security Event
type: NamedIndividual
related: Isolate
definition: An event involving actions to create logical or physical barriers that isolate compromised components, preventing adversary movement and reducing attack surfaces.

Java Archive
type: Class
subclass of: Archive File
subclass of: Software Package
definition: A JAR (Java ARchive) is a package file format typically used to aggregate many Java class files and associated metadata and resources (text, images, etc.) into one file for distribution.

JavaScript Blob
type: Class
subclass of: Binary Large Object
type: NamedIndividual
definition: A JavaScript Blob is a Blob that was created by a JavaScript Blob() constructor call or equivalent function.

Job Function Access Pattern Analysis
type: Class
subclass of: UserBehaviorAnalysis
subclass of: Restriction
  on property: analyzes
  some values from: Authorization
type: NamedIndividual
analyzes: Authorization
kb-reference: Reference-AnomalyDetectionUsingAdaptiveBehavioralProfiles SecuronixInc
d3fend-id: D3-JFAPA
kb-article: ## How it works Peer group analysis identifies functionally similar groups of actors (users or resources) based on categorizations such as job title, organizational hierarchy, or other attribute that indicates similarity of job function. Current user access activity is then compared to the appropriate peer group behavior profile to identify anomalies. ## Considerations Potential for false positives from anomalies that are not associated with malicious activity.
definition: Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department.

Job Schedule
type: Class
subclass of: Digital Information
subclass of: Restriction
  on property: contains
  some values from: Scheduled Job
subclass of: Restriction
  on property: modified-by
  some values from: Job Scheduler Software
type: NamedIndividual
contains: Scheduled Job
modified-by: Job Scheduler Software
synonym: Task Schedule
definition: A job schedule contains specification of tasks to be executed at particular times or time intervals. The schedule is a plan that enacted by a task scheduling process. In Windows, the schedule can be accessed at 'C:\Windows\System32\Tasks' or in the registry. In Linux, the schedule is located at '/etc/crontab'

Job Scheduler Software
type: Class
subclass of: System Service Software
subclass of: Restriction
  on property: creates
  some values from: Scheduled Job
subclass of: Restriction
  on property: modifies
  some values from: Job Schedule
subclass of: Restriction
  on property: modifies
  some values from: Scheduled Job
type: NamedIndividual
creates: Scheduled Job
modifies: Job Schedule
modifies: Scheduled Job
definition: A job scheduler software is operating system software that when run executes scheduled tasks (time-scheduling in the sense of wall clock time; not operating system scheduling of processes for multitasking). Processes running such software are task scheduler processes. In Windows, Scheduled Tasks are created and managed by the Task Scheduler. In Unix-like OSes, the `cron` utitility serves a similar role.
synonym: Task Scheduler Software

K-Center Clustering
type: Class
subclass of: Graph-based Clustering
type: NamedIndividual
d3fend-id: D3A-KCC
definition: K-center Clustering is a type of clustering based on an combinatorial optimization methods. It clusters a set of points so as to minimize the maximum intercluster distance.
kb-article: ## How it works An example K-center Clustering problem is to mimimize the number of points in a set that are necessary so that a every other point in the set is within some fixed distance of those points. For instance, given n cities with specified distances, one wants to build k warehouses in different cities and minimize the maximum distance of a city to a warehouse. ## Considerations - **Scalability**: Exact solutions are NP-hard. However, algorithms that have been proven effective and create no more than 2x the optimal set of clusters can run in O(kn) proportional to k*n where k is the minimum number of clusters and n is the number of data points being clustered. ## Key Test Considerations - **Unsupervised Learning**: - **Number of Clusters**: The Gonzalez (Gon) algorithm guarantees creating no more than twice the optimal number of clusters, where the optimal number is the minimum number of clusters to minimize total distance between representative points in the clusters [1]. - **Cluster Analysis**: - **Rand Index and Adjusted Rand Index**: Given ground truth set of class labels for the data, the Rand Index is a measure of the similarity between two data clusterings. The Rand Index is the accuracy of determining if a link belongs within a cluster or not. A form of the Rand Index may be defined that is adjusted for the chance grouping of elements, this is the Adjusted Rand Index [5]. - **Adjusted Mutual Information**: Given ground truth set of class labels for the data, Adjusted Mutual Information corrects the effect of agreement solely due to chance between clusterings, similar to the way the Adjusted Rand Index corrects the Rand Index [6]. - **Connection-based Clustering**: - **Choice of Distance Metric**: The outcome can vary significantly depending on the chosen distance metric (e.g., Euclidean, Manhattan). - **Sensitivity**: Connection-based method can be sensitive to outliers, which might affect the quality of the clusters formed. - **K-center Clustering**:…

K-Fold Cross-Validation
type: Class
subclass of: Resampling Ensemble
type: NamedIndividual
d3fend-id: D3A-KFCV
definition: Cross-validation is a resampling procedure used to evaluate machine learning models on a limited data sample. The procedure has a single parameter called k that refers to the number of groups that a given data sample is to be split into. As such, the procedure is often called k-fold cross-validation. When a specific value for k is chosen, it may be used in place of k in the reference to the model, such as k=10 becoming 10-fold cross-validation
kb-article: ## References K-Fold Cross-Validation. Machine Learning Mastery. [Link](https://machinelearningmastery.com/k-fold-cross-validation/#:~:text=Cross%2Dvalidation%20is%20a%20resampling,k%2Dfold%20cross%2Dvalidation).

K-Nearest Neighbors
type: Class
subclass of: Classification
type: NamedIndividual
d3fend-id: D3A-KNN
kb-article: ## **How it works** The goal of the k-nearest neighbor algorithm is to identify the nearest neighbors of a given query point, so that we can assign a class label to that point. To determine which data points are closest to a given query point, the distance between the query point and the other data points will need to be calculated. The distance measures used can vary depending on the data set or implementation and help inform decision boundaries, which query points into different regions. Then, by defining the k-value (the number of neighbors to be checked to determine the classification of a specific query point), the data can be assigned its class label. For classification problems, a class label is assigned on the basis of a majority vote—i.e. the label that is most frequently represented around a given data point is used (the term “majority vote” is commonly used in literature, however, the technique is more technically considered “plurality voting”). Regression problems use a similar concept as classification problem, but in this case, the average the k nearest neighbors is taken to make a prediction about a classification. The main distinction here is that classification is used for discrete values, whereas regression is used with continuous ones. Unlike other algorithms that explicitly model the problem, such as linear regression, KNN is instance-based. It means that the algorithm doesn't explicitly learn a model. Instead, it memorizes the training instances and uses them as "knowledge" for the prediction phase. It's also worth noting that the KNN algorithm is also part of a family of “lazy learning” models, meaning that it only stores a training dataset versus undergoing a training stage. ## **Considerations** * **Scaling:** Scaling is a problem as KNN is a lazy algorithm and takes up more memory and storage compared to other classification methods. * **Implementation and Hyperparameters:** As KNN only requires a k-value and a distance metric, it is often a…
definition: The k-nearest neighbors algorithm, also known as KNN or k-NN, is a non-parametric, supervised learning classifier, which uses proximity to make classifications or predictions about the grouping of an individual data point.

K-means Clustering
type: Class
subclass of: Centroid-based Clustering
type: NamedIndividual
d3fend-id: D3A-KMC
kb-article: ## References Towards Data Science. (n.d.). Understanding K-means Clustering in Machine Learning. [Link](https://towardsdatascience.com/understanding-k-means-clustering-in-machine-learning-6a6e67336aa1)
definition: K-means algorithm identifies k number of centroids, and then allocates every data point to the nearest cluster, while keeping the centroids as small as possible.

Kendall's Rank Correlation Coefficient
type: Class
subclass of: Rank Correlation
type: NamedIndividual
d3fend-id: D3A-KRCC
definition: Kendall's $\\tau$ between and is given by $(n_c - n_d) / \\sqrt((n_c+n_d+n_x)(n_c+n_d+n_y)$, where is the number of concordant pairs of observations, is the number of discordant pairs, is the number of ties involving only the variable, and is the number of ties involving only the variable." ;
synonym: Kendall's Tau Coefficient
kb-article: ## References 1. Wolfram Research. (2012). KendallTau. Wolfram Language function. [Link](https://reference.wolfram.com/language/ref/KendallTau.html) 1. Kendall's Tau. (2023, May 23). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Kendall_rank_correlation_coefficient]""",

Kerberos Ticket
type: Class
subclass of: Access Token
type: NamedIndividual
definition: An access ticket/token issued by a Kerberos system.

Kerberos Ticket Granting Service Ticket
type: Class
subclass of: Kerberos Ticket
definition: A Kerberos ticket-granting service (TGS) ticket is given in response to requesting a Kerberos TGS request.
alternative label: TGS Ticket

Kerberos Ticket Granting Ticket
type: Class
subclass of: Kerberos Ticket
subclass of: Ticket Granting Ticket
type: NamedIndividual
definition: A ticket granting ticket issued by a Kerberos system; that is, a ticket that grants a user domain admin access.

Kerberos Ticket Granting Ticket Account
type: Class
subclass of: Service Account
subclass of: Restriction
  on property: creates
  some values from: Kerberos Ticket Granting Ticket
type: NamedIndividual
creates: Kerberos Ticket Granting Ticket
synonym: krbtgt
definition: KRBTGT is an account used by Key Distribution Center (KDC) service to issue Ticket Granting Tickets (TGTs) as part of the Kerberos authentication protocol.

Kernel
type: Class
subclass of: System Software
subclass of: Restriction
  on property: contains
  some values from: Kernel Process Table
subclass of: Restriction
  on property: loads
  some values from: Application
subclass of: Restriction
  on property: manages
  some values from: Operating System Process
subclass of: Restriction
  on property: manages
  some values from: UserProcess
subclass of: Restriction
  on property: may-contain
  some values from: Hardware Driver
subclass of: Restriction
  on property: may-contain
  some values from: Kernel Module
type: NamedIndividual
contains: Kernel Process Table
loads: Application
manages: Operating System Process
manages: UserProcess
may-contain: Hardware Driver
may-contain: Kernel Module
definition: The kernel is a computer program that constitutes the central core of a computer's operating system. It has complete control over everything that occurs in the system. As such, it is the first program loaded on startup, and then manages the remainder of the startup, as well as input/output requests from software, translating them into data processing instructions for the central processing unit. It is also responsible for managing memory, and for managing and communicating with computing peripherals, like printers, speakers, etc. The kernel is a fundamental part of a modern computer's operating system.

Kernel-based Process Isolation
type: Class
subclass of: Execution Isolation
subclass of: Restriction
  on property: isolates
  some values from: Process
type: NamedIndividual
isolates: Process
kb-reference: Reference-OverviewOfTheSeccompSandbox
d3fend-id: D3-KBPI
definition: Using kernel-level capabilities to isolate processes.
comment: e.g. KVM

Kernel API Sensor
type: Class
subclass of: Endpoint Sensor
subclass of: Restriction
  on property: monitors
  some values from: System Call
type: NamedIndividual
monitors: System Call
definition: Monitors system calls (operating system api functions).

Kernel Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Kernel
definition: An event involving operations at the kernel level of an operating system, encompassing interactions with core system resources such as drivers, modules, system calls, and other privileged processes. Kernel events are critical for understanding low-level system behavior and ensuring the integrity of the operating environment.

Kernel Module
type: Class
subclass of: Object File
type: NamedIndividual
alternative label: LKM
alternative label: Loadable Kernel Module
definition: A loadable kernel module (LKM) is an object file that contains code to extend the running kernel, or so-called base kernel, of an operating system. LKMs are typically used to add support for new hardware (as device drivers) and/or filesystems, or for adding system calls. When the functionality provided by a LKM is no longer required, it can be unloaded in order to free memory and other resources. Most current Unix-like systems and Microsoft Windows support loadable kernel modules, although they might use a different name for them, such as kernel loadable module (kld) in FreeBSD, kernel extension (kext) in macOS,[1] kernel extension module in AIX, kernel-mode driver in Windows NT[2] and downloadable kernel module (DKM) in VxWorks. They are also known as kernel loadable modules (or KLM), and simply as kernel modules (KMOD).

Kernel Module Event
type: Class
subclass of: Kernel Event
subclass of: Restriction
  on property: has-participant
  some values from: Hardware Driver
subclass of: Restriction
  on property: has-participant
  some values from: Kernel Module
definition: An event involving the management of kernel modules, such as the loading or unloading of device drivers, extensions, or other dynamically linked components essential for kernel functionality.

Kernel Module Load Event
type: Class
subclass of: Kernel Module Event
subclass of: Restriction
  on property: precedes
  some values from: Memory Allocation Event
definition: An event representing the loading of a kernel module, such as a device driver or dynamically linked extension, into the operating system kernel to extend or modify its capabilities.

Kernel Module Unload Event
type: Class
subclass of: Kernel Module Event
subclass of: Restriction
  on property: preceded-by
  some values from: Kernel Module Load Event
subclass of: Restriction
  on property: precedes
  some values from: Memory Deletion Event
definition: An event representing the removal of a kernel module from the operating system kernel, deallocating resources and potentially altering system functionality.

Kernel Process Table
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A data structure in the kernel which is a table containing all of the information that must be saved when the CPU switches from running one process to another in a multitasking system. It allows the operating system to track all the process's execution status, and contains the For every process managed by the kernel, there is a process control block (PCB) in the process table.

Keyboard Input Device
type: Class
subclass of: Input Device
type: NamedIndividual
alternative label: Computer Keyboard
definition: A computer keyboard is a typewriter-style device which uses an arrangement of buttons or keys to act as mechanical levers or electronic switches. Following the decline of punch cards and paper tape, interaction via teleprinter-style keyboards became the main input method for computers. A keyboard is also used to give commands to the operating system of a computer, such as Windows' Control-Alt-Delete combination. Although on Pre-Windows 95 Microsoft operating systems this forced a re-boot, now it brings up a system security options screen.
alternative label: Keyboard

Kiosk Computer
type: Class
subclass of: Shared Computer
definition: An interactive kiosk is a computer terminal featuring specialized hardware and software that provides access to information and applications for communication, commerce, entertainment, or education. Early interactive kiosks sometimes resembled telephone booths, but have been embraced by retail, food service and hospitality to improve customer service and streamline operations. Interactive kiosks are typically placed in high foot traffic settings such as shops, hotel lobbies or airports.
alternative label: Interactive Kiosk

Kurtosis
type: Class
subclass of: Distribution Properties
type: NamedIndividual
d3fend-id: D3A-KUR
definition: The measure of the "fatness" of the tails of a pmf or pdf. The fourth standardized moment of the distribution.
kb-article: ## References Wikipedia. (n.d.). Probability distribution. [Link](https://en.wikipedia.org/wiki/Probability_distribution)

LAN Access Mediation
type: Class
subclass of: Network Access Mediation
subclass of: Restriction
  on property: isolates
  some values from: Local Area Network
type: NamedIndividual
isolates: Local Area Network
kb-reference: Reference-WhatIsNetworkAccessControl
d3fend-id: D3-LAMED
comment: Layer 2 Enforcement
definition: LAN access mediation encompasses the application of strict access control policies, systematic verification of devices, and authentication mechanisms to govern connectivity to a Local Area Network.
kb-article: ## How it works LAN Access Mediation is a network security approach that manages and controls access to a Local Area Network by using key components such as Access Control Lists (ACLs) to specify which devices are allowed or denied access, Port Security to restrict device connections to specific switch ports, RADIUS for determining the level of access or specific resources available to users or devices, and 802.1X for enforcing device authentication before granting network access. This comprehensive strategy ensures that only authorized devices and users can connect to the network, enhancing overall security.

Laptop Computer
type: Class
subclass of: Personal Computer
definition: A laptop computer (also laptop), is a small, portable personal computer (PC) with a "clamshell" form factor, typically having a thin LCD or LED computer screen mounted on the inside of the upper lid of the clamshell and an alphanumeric keyboard on the inside of the lower lid. The clamshell is opened up to use the computer. Laptops are folded shut for transportation, and thus are suitable for mobile use. Its name comes from lap, as it was deemed to be placed on a person's lap when being used. Although originally there was a distinction between laptops and notebooks (the former being bigger and heavier than the latter), as of 2014, there is often no longer any difference. Today, laptops are commonly used in a variety of settings, such as at work, in education, for playing games, web browsing
alternative label: Laptop
alternative label: Notebook

Lateral Movement Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Lateral Movement
type: NamedIndividual
enables: Lateral Movement

Legacy System
type: Class
subclass of: Digital System
type: NamedIndividual
definition: In computing, a legacy system is an old method, technology, computer system, or application program, "of, relating to, or being a previous or outdated computer system," yet still in use. Often referencing a system as "legacy" means that it paved the way for the standards that would follow it. This can also imply that the system is out of date or in need of replacement.
synonym: Legacy Digital System

Levenschtein Matching
type: Class
subclass of: Approximate String Matching
type: NamedIndividual
d3fend-id: D3A-LM
synonym: Edit Distance
kb-article: ## References 1. Navarro, G. (2001). A guided tour to approximate string matching. _ACM Computing Surveys_, 33(1), 31-88. [Link](https://doi.org/10.1145/375360.375365)
definition: The Levenshtein distance (LD) is a metric for measuring the differences between two sequences - or strings. Informally, the LD is the number of individual edits one would have to make to turn one sequence into another.

Linear Classifier
type: Class
subclass of: Classification
type: NamedIndividual
d3fend-id: D3A-LC
kb-article: ## References A Look at the Maths Behind Linear Classification. Towards Data Science. [Link](https://towardsdatascience.com/a-look-at-the-maths-behind-linear-classification-166e99a9e5fb).
definition: A linear classifier is a model that makes a decision to categories a set of data points to a discrete class based on a linear combination of its explanatory variables

Linear Logic Programming
type: Class
subclass of: Logic Programming
type: NamedIndividual
d3fend-id: D3A-LLP
definition: Linear logic programming is a form of logic programming that uses linear logic, that is, it emphasizes the use of formulas as resources.
kb-article: ## References 1. Cosmo, R. and Miller D. (2019, May 24). _Linear logic_. Stanford Encyclopedia of Philosophy. [Link](https://plato.stanford.edu/entries/logic-linear/#LinLogComSci) 2. Linear logic programming. (2023, May 16). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Logic_programming#Linear_logic_programming)

Linear Regression
type: Class
subclass of: Regression Analysis
type: NamedIndividual
d3fend-id: D3A-LR
definition: Statistical regression method used for predictive analysis by modeling the linear relationship between independent and dependent variables.
kb-article: ## How it works Takes independent variables (i.e. covariate, features, predictors, input variables) and dependent variables (i.e. response, output, “thing to be estimated”) and produces the coefficient(s) and intercept for a linear equation (e.g. (β1, β0) for y = β1x + β0) which predicts the relationship between the independent and independent variables by minimizing a cost function, Mean Squared Error, either directly in the case of univariate linear regression or by gradient descent* in the case of multivariate linear regression. ## Considerations - There are four principal assumptions required for good results using linear regression (the first letters of the four principal assumptions form the "LINE" mnemonic): - Linearity and Additivity - Independent Residuals - Normal Residual Distributions - Equal Variances (i.e. homoscedasticity) - Linear regression is a low variance/high bias model. - Optimizers like Adam, Batch, and Mini-Batch and others are available for certain applications and data sets. - A large learning ratio or training coefficient may lead to divergent behavior of the model and too small of values may lead to long run times and inefficiency. ## Verification Approach - Models are often evaluated by examining one or more of the metrics of R2, Root Mean Squared Error (RMSE), Mean Absolute Error (MAE), and Mean Absolute Percentage Error (MAPE). - While there is no generally accepted single best performance metric as a criterion, users of linear regression should consider the suitability of one or more of these metrics for assessing the performance of their model. - Use well known data sets to verify model execution. ## Validation Approach - Violating the principal assumptions of linear regression results in poor or misleading results. - Ensure data is truly representative and if there are any known biases. ## References 1. Gawali, Suvarna. “Linear Regression Algorithm to Make Predictions Easily.” Analytics Vidhya, 22 July 2022, https://www.analyticsvid…

Linear Regression Learning
type: Class
subclass of: Regression Analysis Learning
type: NamedIndividual
d3fend-id: D3A-LRL
kb-article: ## References - Gawali, Suvarna. “Linear Regression Algorithm to Make Predictions Easily.” Analytics Vidhya, 22 July 2022, https://www.analyticsvidhya.com/blog/2021/06/linear-regression-in-machine-learning/. - Nau, Robert. “Statistical Forecasting: Notes On Regression and Time Series Analysis.” Introduction to Linear Regression Analysis, Duke University Fuqua School of Business, 18 Aug. 2020, https://people.duke.edu/~rnau/regintro.htm. - Ng, Ritchie. “Evaluating a Linear Regression Model.” Ritchieng.github.io, 8 Jan. 2023, https://www.ritchieng.com/machine-learning-evaluate-linear-regression-model/. - Bochkarev, Alexei. "A New Typology Design of Performance Metrics to Measure Errors in Machine Learning Regression Algorithms", 2019, https://www.researchgate.net/publication/330661543_A_New_Typology_Design_of_Performance_Metrics_to_Measure_Errors_in_Machine_Learning_Regression_Algorithms.
definition: A supervised learning method that builds a linear regression model using training data.

Link
type: Class
subclass of: D3FEND Core
subclass of: Digital Information Bearer
definition: A link is a connection or association between two entities that facilitates communication, interaction, or data transfer.

Linux Clone
type: Class
subclass of: OS API Create Process
definition: Creates a child process and provides more precise control over the data shared between the parent and child processes.

Linux Clone3
type: Class
subclass of: OS API Create Process
definition: Creates a child process and provides more precise control over the data shared between the parent and child processes. Newer system call.

Linux Clone3 Argument CLONE_THREAD
type: Class
subclass of: OS API Create Thread
definition: A flag parameter to the Clone3 syscall. If set, the child is placed in the same thread group as the calling process.

Linux Clone Argument CLONE_THREAD
type: Class
subclass of: OS API Create Thread
definition: A flag parameter to the Clone syscall. If set, the child is placed in the same thread group as the calling process.

Linux Connect
type: Class
subclass of: OS API Connect Socket
definition: Initiate a connection on a socket.

Linux Creat
type: Class
subclass of: OS API Create File
definition: Equivalent to calling Linux Open with flags equal to O_CREAT|O_WRONLY|O_TRUNC.

Linux Delete Module
type: Class
subclass of: OS API Unload Module
definition: Attempts to remove the unused loadable module entry identified by name. If the module has an exit function, then that function is executed before unloading the module.

Linux Execve
type: Class
subclass of: OS API Exec
definition: Executes a program by replacing the calling process with a new program, with newly initialized stack, heap, and (initialized and uninitialized) data segments. The PID stays the same.

Linux Execveat
type: Class
subclass of: OS API Exec
definition: Execute program relative to a directory file descriptor. Behavior is similar to Linux Execve.

Linux Fork
type: Class
subclass of: OS API Create Process
definition: Creates a child process with unique PID but retains parent PID as Parent Process Identifier (PPID).

Linux Init_Module
type: Class
subclass of: OS API Load Module
definition: Loads an ELF image into kernel space, performs any necessary symbol relocations, initializes module parameters to values provided by the caller, and then runs the module's init function.

Linux Kill Argument SIGKILL
type: Class
subclass of: OS API Terminate Process
definition: Send SIGKILL signal to a process.

Linux Mmap
type: Class
subclass of: OS API Allocate Memory
definition: Map files or devices into memory.

Linux Mmap2
type: Class
subclass of: OS API Allocate Memory
definition: Map files or devices into memory.

Linux Munmap
type: Class
subclass of: OS API Free Memory
definition: Unmap files or devices from memory.

Linux Open Argument O_CREAT
type: Class
subclass of: OS API Create File
definition: Create a regular file.

Linux Open Argument O_RDONLY, O_WRONLY, O_RDWR
type: Class
subclass of: OS API Open File
definition: Opens a file specified by pathname.

Linux OpenAt2 Argument O_CREAT
type: Class
subclass of: OS API Create File
definition: Create a regular file. Extension of Linux Openat.

Linux OpenAt2 Argument O_RDONLY, O_WRONLY, O_RDWR
type: Class
subclass of: OS API Open File
definition: Extension of Linux Openat.

Linux OpenAt Argument O_CREAT
type: Class
subclass of: OS API Create File
definition: Create a regular file. Same functionality as Linux Open but slight differences in parameter.

Linux OpenAt Argument O_RDONLY, O_WRONLY, O_RDWR
type: Class
subclass of: OS API Open File
definition: Same functionality as Linux Open but slight differences in parameter.

Linux Pause Process
type: Class
subclass of: OS API Suspend Process
definition: Causes the calling process to sleep until a signal is delivered that either terminates the process or causes the invocation of a signal-catching function.

Linux Pause Thread
type: Class
subclass of: OS API Suspend Thread
definition: Causes the calling thread to sleep until a signal is delivered that either terminates the thread or causes the invocation of a signal-catching function.

Linux Ptrace Argument PTRACE_ATTACH
type: Class
subclass of: OS API Access Process
definition: Attach to the process specified in pid, making it a tracee of the calling process.

Linux Ptrace Argument PTRACE_CONT
type: Class
subclass of: OS API Resume Process
definition: Restart the stopped tracee process.

Linux Ptrace Argument PTRACE_GETREGS
type: Class
subclass of: OS API Save Registers
definition: Copy the tracee's general-purpose or floating-point registers, respectively, to the address data in the tracer.

Linux Ptrace Argument PTRACE_INTERRUPT
type: Class
subclass of: OS API Suspend Process
definition: Stops a tracee.

Linux Ptrace Argument PTRACE_PEEKTEXT
type: Class
subclass of: OS API Read Memory
definition: Read a word at the address addr in the tracee's memory, returning the word as the result of the ptrace() call.

Linux Ptrace Argument PTRACE_POKETEXT
type: Class
subclass of: OS API Write Memory
definition: Copy the word data to the address addr in the tracee's memory.

Linux Ptrace Argument PTRACE_SETREGS
type: Class
subclass of: OS API Set Registers
definition: Modify the tracee's general-purpose or floating-point registers, respectively, from the address data in the tracer.

Linux Ptrace Argument PTRACE_DETACH
type: Class
subclass of: OS API Resume Process
definition: Restart the stopped tracee as for PTRACE_CONT, but first detach from it.

Linux Ptrace Argument PTRACE_TRACEME
type: Class
subclass of: OS API Trace Process
definition: Indicates that the process is to be traced by its parent.

Linux Read
type: Class
subclass of: OS API Read File
definition: Read from a file descriptor.

Linux Readv
type: Class
subclass of: OS API Read File
definition: Read data into multiple buffers.

Linux Rename
type: Class
subclass of: OS API Move File
definition: Change the name or location of a file.

Linux Renameat
type: Class
subclass of: OS API Move File
definition: Change the name or location of a file. Different parameter handling than Linux Rename.

Linux Renameat2
type: Class
subclass of: OS API Move File
definition: Change the name or location of a file. Additional flags argument.

Linux Socket
type: Class
subclass of: OS API Create Socket
definition: Create an endpoint for communication.

Linux Socketcall Argument SYS_CONNECT
type: Class
subclass of: OS API Connect Socket

Linux Socketcall Argument SYS_SOCKET
type: Class
subclass of: OS API Create Socket

Linux Time
type: Class
subclass of: OS API Get System Time
definition: Get time in seconds.

Linux Unlink
type: Class
subclass of: OS API Delete File
definition: Delete a name and possibly the file it refers to.

Linux Unlinkat
type: Class
subclass of: OS API Delete File
definition: Delete a name and possibly the file it refers to. Different parameter handling than Linux Unlink

Linux Vfork
type: Class
subclass of: OS API Create Process
definition: Create child process that temp suspends parent process until it terminates.

Linux Write
type: Class
subclass of: OS API Write File
definition: Write to a file descriptor.

Linux Writev
type: Class
subclass of: OS API Write File
definition: Write data into multiple buffers.

Linux _Exit
type: Class
subclass of: OS API Terminate Process
definition: Terminate the calling process.

Load Library Event
type: Class
subclass of: Process Event
subclass of: Restriction
  on property: has-participant
  some values from: Shared Library File
subclass of: Restriction
  on property: preceded-by
  some values from: Process Creation Event
definition: An event where a process dynamically loads a library or module into its memory space, extending its capabilities.

Load Module
type: Class
subclass of: System Call
subclass of: Restriction
  on property: loads
  some values from: Hardware Driver
subclass of: Restriction
  on property: loads
  some values from: Kernel Module
type: NamedIndividual
loads: Hardware Driver
loads: Kernel Module
definition: A system call that loads a driver or extension into the kernel.

Local Account Monitoring
type: Class
subclass of: UserBehaviorAnalysis
subclass of: Restriction
  on property: analyzes
  some values from: Local User Account
type: NamedIndividual
analyzes: Local User Account
kb-reference: Reference-AuditUserAccountManagement
kb-reference: Reference-CAR-2016-04-004 SuccessfulLocalAccountLogin
kb-reference: Reference-OSQueryWindowsUserCollectionCode
d3fend-id: D3-LAM
definition: Analyzing local user accounts to detect unauthorized activity.

Local Area Network
type: Class
subclass of: Network
subclass of: Restriction
  on property: may-contain
  some values from: Host
type: NamedIndividual
may-contain: Host
definition: A local area network (LAN) is a computer network that interconnects computers within a limited area such as a residence, school, laboratory, university campus or office building and has its network equipment and interconnects locally managed. Ethernet and Wi-Fi are the two most common transmission technologies in use for local area networks. Historical technologies include ARCNET, Token ring, and AppleTalk.
alternative label: LAN

Local Area Network Attacker
type: Class
subclass of: Local Attacker
subclass of: Restriction
  on property: accesses
  some values from: Local Area Network
definition: An attacker who exploits vulnerabilities within the same local area network.
synonym: LAN Attacker

Local Area Network Traffic
type: Class
subclass of: Intranet Network Traffic
type: NamedIndividual
definition: Intranet local area network (LAN) traffic is network traffic that does not cross a given network's boundaries; where that network is defined as a LAN.

Local Attacker
type: Class
subclass of: Attacker
definition: An attacker who is physically near or on the premises of the target network or systems.

Local Authentication Service
type: Class
subclass of: Authentication Service
subclass of: System Service Software
definition: A local authentication service running on a host can authenticate a user logged into just that local host computer.

Local Authorization Service
type: Class
subclass of: Authorization Service
subclass of: System Service Software
definition: A local authorization service running on a host can authorize a user logged into just that local host computer.

Local File Access Mediation
type: Class
subclass of: System Call Filtering
subclass of: Restriction
  on property: filters
  some values from: Open File
type: NamedIndividual
filters: Open File
kb-reference: Reference-FileAndFolderPermissions
d3fend-id: D3-LFAM
synonym: Local File Access Control
definition: Local file access mediation is the process of an operating system granting or denying a specific access request to a local file.
comment: Replaces d3-LFP

Local File Permissions
type: Class
subclass of: Access Policy Administration
subclass of: Restriction
  on property: restricts
  some values from: Directory
subclass of: Restriction
  on property: restricts
  some values from: File
type: NamedIndividual
kb-reference: Reference-FileAndFolderPermissions
restricts: Directory
restricts: File
d3fend-id: D3-LFP
definition: Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.

Local Resource
type: Class
subclass of: Resource
type: NamedIndividual
alternative label: System Resource
definition: In computing, a system resource, or simply resource, is any physical or virtual component of limited availability within a computer system. Every device connected to a computer system is a resource. Every internal system component is a resource. Virtual system resources include files (concretely file handles), network connections (concretely network sockets), and memory areas. Managing resources is referred to as resource management, and includes both preventing resource leaks (releasing a resource when a process has finished using it) and dealing with resource contention (when multiple processes wish to access a limited resource).

Local Resource Access
type: Class
subclass of: Resource Access
subclass of: Restriction
  on property: accesses
  some values from: Local Resource
type: NamedIndividual
accesses: Local Resource
definition: Ephemeral digital artifact comprising a request of a local resource and any response from that resource.
alternative label: Endpoint Resource Access

Local User Account
type: Class
subclass of: UserAccount
type: NamedIndividual
definition: A user account on a given host is a local user account for that specific host.

Log
type: Class
subclass of: D3FEND Core
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A record of events in the order of their occurrence.
alternative label: Chronology

Log File
type: Class
subclass of: File
subclass of: Restriction
  on property: contains
  some values from: Log
type: NamedIndividual
contains: Log
definition: A log file is a file that records either events that occur in an operating system or other software runs, or messages between different users of a communication software. Logging is the act of keeping a log. In the simplest case, messages are written to a single log file. A transaction log is a file (i.e., log) of the communications between a system and the users of that system, or a data collection method that automatically captures the type, content, or time of transactions made by a person from a terminal with that system. For Web searching, a transaction log is an electronic record of interactions that have occurred during a searching episode between a Web search engine and users searching for information on that Web search engine. Many operating systems, software frameworks and programs include a logging system. A widely used logging standard is syslog, defined in Internet Engineering Task Force (IETF) RFC 5424). The syslog standard enables a dedicated, standardized subsystem to generate, filter, record, and analyze log messages. This relieves software developers of having to design and code their own ad hoc logging systems.

Log Message Function
type: Class
subclass of: Subroutine
definition: Produces an entry in a log.

Logic Programming
type: Class
subclass of: Symbolic AI
type: NamedIndividual
d3fend-id: D3A-LP
definition: Logic programming is a programming paradigm which is largely based on formal logic.
kb-article: ## How it works Any program written in a logic programming language is a set of sentences in logical form, expressing facts and rules about some problem domain. Major logic programming language families include Prolog, answer set programming (ASP) and Datalog. In all of these languages, rules are written in the form of clauses: H :- B_1, ..., B_n. ## References 1. Logic programming. (2023, May 29). In _Wikipedia_. [Link]( https://en.wikipedia.org/wiki/Logic_programming)

Logical Link
type: Class
subclass of: Link
type: NamedIndividual
definition: A Logical Link is an abstract or virtual connection between two entities that facilitates communication or data exchange without requiring a direct physical connection.

Logical Link Mapping
type: Class
subclass of: Network Mapping
subclass of: Restriction
  on property: maps
  some values from: Logical Link
subclass of: Restriction
  on property: maps
  some values from: Network
subclass of: Restriction
  on property: maps
  some values from: Network Node
type: NamedIndividual
kb-reference: Reference-LibreNMSDocsNetworkMapExtension
maps: Logical Link
maps: Network
maps: Network Node
d3fend-id: D3-LLM
definition: Logical link mapping creates a model of existing or previous node-to-node connections using network-layer data or metadata.

Logical Rules
type: Class
subclass of: Symbolic Logic
type: NamedIndividual
d3fend-id: D3A-LR
definition: A logical rule matches event data or set of values to a conditional expression and results in the determination of a truth value, which may be used to determine the next action or step to take.
kb-article: ## How it works Logic rules define a set of patterns that in some patterns must match input data. If the the conditions are met, then the rule will "fire" and some action will be taken, usually notifying a person or another system that the event being monitored needs further processing or attention. ## Key Test Considerations - **Performance (Accuracy)** Identify instances in data where rule is expected to be triggered. Implement traceability and metrics for individual rule performance. Traceability of cases could be implemented as unit tests or as part of a fine-grained classification performance platform. For simple rule-based matching systems with many rules, individual rules may be unused or may create unusually high false positives (or false negatives relative to expectation. - **Performance (Computational)** Generate model performance measures (see Classification Performance Measures), esp. a confusion matrix for each rule and identify outliers and relative contribution of rule to overall performance. ## References 1. Event condition action. (2019, Nov 21). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Event_condition_action). 2. Business rule. (2023, April 10). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Business_rule). 3. YARA. (2023, June 5). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/YARA).

Login Session
type: Class
subclass of: Session
type: NamedIndividual
alternative label: Logon Session
definition: In computing, a login session is the period of activity between a user logging in and logging out of a (multi-user) system. This includes local login sessions, where a user has direct physical access to a computer, as well as domain login sessions, where a user logs into a computer that is part of a network domain.

Logistic Regression
type: Class
subclass of: Regression Analysis
type: NamedIndividual
d3fend-id: D3A-LR
kb-article: ## References Wikipedia. (n.d.). Logistic regression. [Link](https://en.wikipedia.org/wiki/Logistic_regression)
definition: Logistic regression is estimating the parameters of a logistic model.

Logistic Regression Learning
type: Class
subclass of: Regression Analysis Learning
type: NamedIndividual
d3fend-id: D3A-LRL
kb-article: ## References Wikipedia. (n.d.). Logistic regression. [Link](https://en.wikipedia.org/wiki/Logistic_regression)
definition: A supervised learning method that builds a logistic regression model using training data.

Logoff Event
type: Class
subclass of: Authentication Event
subclass of: Restriction
  on property: has-participant
  some values from: Session
subclass of: Restriction
  on property: preceded-by
  some values from: Logon Event
definition: An authentication event where an active session is conclusively terminated, resulting in the cessation of access and deallocation of resources associated with the session, ensuring that the connection to the system, application, or resource no longer exists.

Logon Event
type: Class
subclass of: Authentication Event
subclass of: Restriction
  on property: has-participant
  some values from: Session
definition: An authentication event where a new session is initiated, signifying the successful validation of credentials and establishment of an authorized connection to a system, application, or resource. This marks the beginning of the subject’s authenticated interaction with the system.

Logon User
type: Class
subclass of: System Call
subclass of: Restriction
  on property: authenticates
  some values from: UserAccount
type: NamedIndividual
authenticates: UserAccount

Long Short-term Memory
type: Class
subclass of: Recurrent Neural Network
type: NamedIndividual
d3fend-id: D3A-LSTM
definition: Unlike standard feedforward neural networks, LSTM has feedback connections. Such a recurrent neural network (RNN) can process not only single data points (such as images), but also entire sequences of data (such as speech or video). This characteristic makes LSTM networks ideal for processing and predicting data
kb-article: ## References Wikipedia. (2021, September 29). Long short-term memory. [Link](https://en.wikipedia.org/wiki/Long_short-term_memory)

MAC Address
type: Class
subclass of: Identifier
subclass of: Restriction
  on property: identifies
  some values from: Network Interface Card
type: NamedIndividual
identifies: Network Interface Card
definition: A media access control address (MAC address) is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment.

MacOS Keychain
type: Class
subclass of: Password Store
type: NamedIndividual
alternative label: Keychain
definition: Keychain is the password management system in macOS, developed by Apple. It was introduced with Mac OS 8.6, and has been included in all subsequent versions of the operating system, now known as macOS. A Keychain can contain various types of data: passwords (for websites, FTP servers, SSH accounts, network shares, wireless networks, groupware applications, encrypted disk images), private keys, certificates, and secure notes.

Machine Learning
type: Class
subclass of: Analytic Technique
type: NamedIndividual
d3fend-id: D3A-ML
kb-article: ## References Machine learning." Wikipedia. [Link](https://en.wikipedia.org/wiki/Machine_learning).
definition: Machine learning techniques are computational methods that combine statistics, probability, and optimization to make accurate predictions and/or improve performance.

Mail Network Traffic
type: Class
subclass of: Network Traffic
subclass of: Restriction
  on property: contains
  some values from: Email
type: NamedIndividual
contains: Email
definition: Mail traffic is network traffic that uses a standard mail transfer protocol.

Mail Server
type: Class
subclass of: Server
subclass of: Restriction
  on property: runs
  some values from: Message Transfer Agent
type: NamedIndividual
runs: Message Transfer Agent
alternative label: MX Host
alternative label: Mail Exchanger
alternative label: Email Server Resource
alternative label: MTA
alternative label: Mail transfer agent
alternative label: Message transfer agent
definition: Within the Internet email system, a message transfer agent or mail transfer agent (MTA) or mail relay is software that transfers electronic mail messages from one computer to another using SMTP. The terms mail server, mail exchanger, and MX host are also used in some contexts. Messages exchanged across networks are passed between mail servers, including any attached data files (such as images, multimedia or documents). These servers also often keep mailboxes for email. Access to this email by end users is typically either via webmail or an email client.

Mail Service
type: Class
subclass of: Network Service
definition: A mail service provides the ability to send and receive mail across a computer network. The mail service runs on message transfer agents (i.e., mail servers) and is accessed by users through an email client.
alternative label: Email Service

Matching
type: Class
subclass of: Analytical Purpose

Mathematical Function
type: Class
subclass of: Subroutine
type: NamedIndividual
definition: Computes mathematical expressions.

Maximum-margin Learning
type: Class
subclass of: Intrinsically Semi-supervised Learning
type: NamedIndividual
d3fend-id: D3A-MML
kb-article: ## References Engelen, S., & Hoos, H. (2020). A survey on semi-supervised learning. Machine Learning, 109(2), 299-337. [Link](https://link.springer.com/article/10.1007/s10994-019-05855-6). Support Vector Machines for Machine Learning. [Link](https://machinelearningmastery.com/support-vector-machines-for-machine-learning/#:~:text=The%20distance%20between%20the%20line,called%20the%20Maximal%2DMargin%20hyperplane.)
definition: Maximum-margin classifiers attempt to maximize the distance between the given data points and the decision boundary

Mean
type: Class
subclass of: Central Tendency
type: NamedIndividual
d3fend-id: D3A-MEA
definition: The sum of all measurements divided by the number of observations in the data set.
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)

Mean Absolute Deviation
type: Class
subclass of: Average Absolute Deviation
type: NamedIndividual
d3fend-id: D3A-MAD
kb-article: ## References Wikipedia. (n.d.). Average absolute deviation. [Link](https://en.wikipedia.org/wiki/Average_absolute_deviation)
synonym: MAD
definition: The mean absolute deviation (MAD), also referred to as the "mean deviation" or sometimes "average absolute deviation", is the mean of the data's absolute deviations around the data's mean: the average (absolute) distance from the mean.

Media Generation
type: Class
subclass of: Media Generation
disjoint with: Simulation

Media Server
type: Class
subclass of: Server
definition: A media server is a computer appliance or an application software that stores digital media (video, audio or images) and makes it available over a network. Media servers range from servers that provide video on demand to smaller personal computers or NAS (Network Attached Storage) for the home.

Median
type: Class
subclass of: Central Tendency
type: NamedIndividual
d3fend-id: D3A-MED
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
definition: The middle value that separates the higher half from the lower half of the data set. The median and the mode are the only measures of central tendency that can be used for ordinal data, in which values are ranked relative to each other but are not measured absolutely.

Median Absolute Deviation
type: Class
subclass of: Average Absolute Deviation
type: NamedIndividual
d3fend-id: D3A-MAD
definition: The median absolute deviation (also MAD) is the median of the absolute deviation from the median.
kb-article: ## References Wikipedia. (n.d.). Average absolute deviation. [Link](https://en.wikipedia.org/wiki/Average_absolute_deviation)

Memory Address
type: Class
subclass of: Digital Information
subclass of: Restriction
  on property: addresses
  some values from: Memory Word
type: NamedIndividual
addresses: Memory Word
definition: In computing, a memory address is a reference to a specific memory location used at various levels by software and hardware.

Memory Address Space
type: Class
subclass of: Address Space
subclass of: Restriction
  on property: contains
  some values from: Memory Address
type: NamedIndividual
contains: Memory Address
definition: A memory address space is a space containing memory addresses.

Memory Allocation Event
type: Class
subclass of: Memory Event
definition: An event representing the allocation of memory resources to a process, providing it with the capacity to store data or execute instructions.

Memory Allocation Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: invokes
  some values from: Allocate Memory
type: NamedIndividual
invokes: Allocate Memory
definition: Reserves memory for a running process to use.

Memory Block
type: Class
subclass of: Memory Extent
subclass of: Restriction
  on property: contains
  some values from: Memory Word
subclass of: Restriction
  on property: may-contain
  some values from: Record
type: NamedIndividual
contains: Memory Word
may-contain: Record
definition: In computing (specifically data transmission and data storage), a block, sometimes called a physical record, is a sequence of bytes or bits, usually containing some whole number of records, having a maximum length; a block size. Data thus structured are said to be blocked. The process of putting data into blocks is called blocking, while deblocking is the process of extracting data from blocks. Blocked data is normally stored in a data buffer and read or written a whole block at a time.

Memory Block Start Validation
type: Class
subclass of: Pointer Validation
subclass of: Restriction
  on property: hardens
  some values from: Memory Free Function
type: NamedIndividual
hardens: Memory Free Function
kb-reference: Reference-CManualPointerArithmetic GNU
d3fend-id: D3-MBSV
kb-article: ## How it Works Ensure that a pointer is referencing the beginning of the intended block before using. ## Considerations Be careful with pointer arithmetic.
definition: Ensuring that a pointer accurately references the beginning of a designated memory block.

Memory Boundary Tracking
type: Class
subclass of: Operating System Monitoring
subclass of: Restriction
  on property: analyzes
  some values from: Process Code Segment
type: NamedIndividual
analyzes: Process Code Segment
kb-reference: Reference-InferentialExploitAttemptDetection CrowdstrikeInc
d3fend-id: D3-MBT
kb-article: ## How it works This technique monitors for indicators of whether a return address is outside memory previously allocated for an object (i.e. function, module, process, or thread). If so, code that the return address points to is treated as malicious code. ## Considerations Kernel malware can manipulate memory contents, for example modifying pointers to hide processes, and thereby impact the accuracy of memory allocation information used to perform the analysis.
definition: Analyzing a call stack for return addresses which point to unexpected memory locations.

Memory Deletion Event
type: Class
subclass of: Memory Event
subclass of: Restriction
  on property: has-participant
  some values from: Memory Free Function
subclass of: Restriction
  on property: preceded-by
  some values from: Memory Allocation Event
definition: An event marking the release or deallocation of memory resources, reclaiming them for reuse within the system.

Memory Device Event
type: Class
subclass of: Hardware Device Event
subclass of: Restriction
  on property: has-participant
  some values from: Primary Storage
definition: An event describing activity in primary storage devices, such as DRAM or SRAM memory initialization, reconfiguration, or failures.

Memory Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Memory Address
subclass of: Restriction
  on property: has-participant
  some values from: Memory Extent
definition: An event capturing operations on the memory resources of a system, encompassing allocation, modification, access, protection, or deallocation.

Memory Extent
type: Class
subclass of: Digital Information
definition: A memory extent is a defined, contiguous region of memory within a computing system, characterized by its size, location, and purpose. It represents an abstraction of physical or virtual memory used for storing data, instructions, or other computational artifacts.

Memory Free Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: invokes
  some values from: Free Memory
type: NamedIndividual
invokes: Free Memory
definition: Releases previously reserved memory associated with a process.

Memory Management Unit
type: Class
subclass of: Processor Component
subclass of: Restriction
  on property: contains
  some values from: TranslationLookasideBuffer
subclass of: Restriction
  on property: creates
  some values from: VirtualAddress
subclass of: Restriction
  on property: manages
  some values from: Page Table
subclass of: Restriction
  on property: manages
  some values from: Storage
type: NamedIndividual
contains: TranslationLookasideBuffer
creates: VirtualAddress
manages: Page Table
manages: Storage
definition: A computer’s memory management unit (MMU) is the physical hardware that handles its virtual memory and caching operations. The MMU is usually located within the computer’s central processing unit (CPU), but sometimes operates in a separate integrated chip (IC).

Memory Management Unit Component
type: Class
subclass of: Hardware Device
definition: A Memory Management Unit Component is a hardware or software element that contributes to the functionality of a Memory Management Unit, which is responsible for managing and translating memory addresses in a computing system.

Memory Map Event
type: Class
subclass of: Memory Event
subclass of: Restriction
  on property: has-participant
  some values from: VirtualMemorySpace
subclass of: Restriction
  on property: preceded-by
  some values from: Memory Allocation Event
definition: An event representing the mapping of memory regions into a process's virtual address space, enabling efficient access to shared or reserved memory.

Memory Modification Event
type: Class
subclass of: Memory Event
subclass of: Restriction
  on property: preceded-by
  some values from: Memory Allocation Event
definition: An event where a process modifies allocated memory, potentially altering its content, behavior, or state.

Memory Pool
type: Class
subclass of: Memory Extent
subclass of: Restriction
  on property: contains
  some values from: Memory Block
type: NamedIndividual
contains: Memory Block
definition: Memory pools, also called fixed-size blocks allocation, is the use of pools for memory management… preallocating a number of memory blocks with the same size called the memory pool. The application can allocate, access, and free blocks represented by handles at run time.

Memory Protection Unit
type: Class
subclass of: Processor Component
type: NamedIndividual
definition: A Memory Protection Unit (MPU) is a processor component that enforces access control policies on memory regions to ensure the integrity, security, and proper operation of a computing system.
synonym: MPU

Memory Read Event
type: Class
subclass of: Memory Event
subclass of: Restriction
  on property: has-participant
  some values from: Raw Memory Access Function
subclass of: Restriction
  on property: preceded-by
  some values from: Memory Allocation Event
definition: An event where a process retrieves data from a specific memory address, either from its own allocated space or that of another process.

Memory Word
type: Class
subclass of: Memory Extent
type: NamedIndividual
definition: A memory word is the natural unit of data used by a particular computer processor design; a fixed-size piece of data handled as a unit by the instruction set or the hardware of the processor.

Memory Write Event
type: Class
subclass of: Memory Event
subclass of: Restriction
  on property: preceded-by
  some values from: Memory Allocation Event
definition: An event where a process writes data to a memory address, storing new information or updating existing content.

Message Analysis
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Detect
type: NamedIndividual
enables: Detect
d3fend-id: D3-MA
synonym: Electronic Message Analysis
definition: Analyzing email or instant message content to detect unauthorized activity.
synonym: Email Or Messaging Analysis
kb-article: ## Technique Overview Email and messaging are frequently used to deliver malicious content to targets. These enterprise capabilities are used to deliver software exploits or social engineering tricks. If the recipient of a message trusts the sender, attackers can avoid escalating suspicion. Emails and messages are also complex data structures. They contain files and links, and complex data encodings which vary region to region. Thus the defensive techniques used to analyze emails and messages are highly varied ranging from deep content analysis and execution to social network graph-style analytics to analyze trust or risk.

Message Authentication
type: Class
subclass of: Message Hardening
subclass of: Restriction
  on property: authenticates
  some values from: UserToUserMessage
type: NamedIndividual
authenticates: UserToUserMessage
kb-reference: Reference-DomainKeysIdentifiedMail-Signatures-IETF
kb-reference: Reference-SecureMultipurposeInternetMailExtensionsMIME-Version3.1
d3fend-id: D3-MAN
definition: Authenticating the sender of a message and ensuring message integrity.
kb-article: ## How it works ### Digital Signature Digital signatures are used to verifying a message is from the expected sender. In email, Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol is typically used to digitally sign messages. A hash value of the sender's message is created and encrypted with the sender's private key to create a digital signature. The message and the digital signature are sent to the recipient where the sender's public key is used to decrypt the digital signature and compute the hash of the message. The computed hash is compared with the hash from the received message, and any difference in the hash values signify the message did not originate from the sender and has been alerted in transit. ### Message Authentication Code (MAC) MAC is a fixed size string that is appended to a message to provide message authentication and integrity. The sender MAC signing algorithm takes as input a secret symmetric key shared between sender and recipient and the message to calculate a short tag that is appended to the message. The recipient receives the message with the appended tag, and a MAC verification algorithm is run using the symmetric key to verify the message came from the stated sender and ensure the message has not been tampered with. ## Considerations - Public keys associated with digital signatures should be verified by a Certification Authority (CA) to prevent impersonation. The CA verifies the owner of a public key and puts the sender's identity and public key into a certificate that is signed by the CA. - Digital signatures provide non-repudiation where a third party can verify the authenticity of the message using the sender's digital certificate signed by the CA. - Symmetric keys must be exchanged securely via a private channel and management of new symmetric keys are needed for each pair of participants wishing to exchange messages.

Message Encryption
type: Class
subclass of: Message Hardening
subclass of: Restriction
  on property: encrypts
  some values from: UserToUserMessage
type: NamedIndividual
encrypts: UserToUserMessage
kb-reference: Reference-SecureMultipurposeInternetMailExtensionsMIME-Version3.1
d3fend-id: D3-MENCR
definition: Encrypting a message body using a cryptographic key.
kb-article: ## How it works ### Asymmetric Cryptography Asymmetric encryption is typically accomplished using public and private key certificates based on the X.509 standard. The sender encrypts messages using the recipient's public key and the receipt decrypts the message using their private key. Standards that can be used to implement message encryption include S/MIME (Secure/Multipurpose Internet Mail Extensions) and PGP. ### Symmetric Cryptography Symmetric encryption uses the same cryptographic key by both the sender and receiver to encrypt and decrypt a message. Asymmetric key exchange protocols such as Diffie-Hellman can be used to share the cryptographic key with the recipient. ## Considerations - Separate configuration settings to enable message encryption are often needed for each messenger client (e.g. webmail, desktop client, mobile). - Continuous monitoring to ensure private keys are not compromised and the certificate authority (CA) is trusted. - Secure transfer of private keys between multiple devices.

Message Hardening
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Harden
type: NamedIndividual
enables: Harden
d3fend-id: D3-MH
definition: Email or Messaging Hardening includes measures taken to ensure the confidentiality and integrity of user to user computer messages.
synonym: Email Or Messaging Hardening

Message Transfer Agent
type: Class
subclass of: Mail Service
type: NamedIndividual
alternative label: Mail Transfer Agent
alternative label: MTA
definition: A message transfer agent or mail transfer agent (MTA) or mail relay is software that transfers electronic mail messages from one computer to another using a client-server application architecture. An MTA implements both the client (sending) and server (receiving) portions of the Simple Mail Transfer Protocol.

Metadata
type: Class
subclass of: Digital Information
definition: Metadata is information which describes aspects of other information.

Microcode
type: Class
subclass of: Firmware
definition: Microcode is a computer hardware technique that interposes a layer of organization between the CPU hardware and the programmer-visible instruction set architecture of the computer. As such, the microcode is a layer of hardware-level instructions that implement higher-level machine code instructions or internal state machine sequencing in many digital processing elements.

Microsoft HTML Application
type: Class
subclass of: HTML File
subclass of: Restriction
  on property: may-contain
  some values from: Executable Script
type: NamedIndividual
may-contain: Executable Script
definition: An HTML Application (HTA) is a Microsoft Windows program whose source code consists of HTML, Dynamic HTML, and one or more scripting languages supported by Internet Explorer, such as VBScript or JScript.
synonym: HTA

Mobile Phone
type: Class
subclass of: Personal Computer
definition: A mobile phone, cellular phone, cell phone, cellphone or hand phone, sometimes shortened to simply mobile, cell or just phone, is a portable telephone that can make and receive calls over a radio frequency link while the user is moving within a telephone service area. The radio frequency link establishes a connection to the switching systems of a mobile phone operator, which provides access to the public switched telephone network (PSTN). Modern mobile telephone services use a cellular network architecture and, therefore, mobile telephones are called cellular telephones or cell phones in North America. In addition to telephony, digital mobile phones (2G) support a variety of other services, such as text messaging, MMS, email, Internet access, short-range wireless communications (infrared,
alternative label: Cellphone
alternative label: Cellular Phone

Modal Logic
type: Class
subclass of: Symbolic AI
type: NamedIndividual
d3fend-id: D3A-ML
kb-article: ## References 1. Modal logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic)
definition: Modal logic is a collection of formal systems developed to represent statements about necessity and possibility. It plays a major role in philosophy of language, epistemology, metaphysics, and natural language semantics.

Mode
type: Class
subclass of: Central Tendency
type: NamedIndividual
d3fend-id: D3A-MOD
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
definition: The most frequent value in the data set. This is the only central tendency measure that can be used with nominal data, which have purely qualitative category assignments.

Model
type: Class
subclass of: Defensive Tactic
type: NamedIndividual
type: Defensive Tactic
display-priority: 1
definition: The model tactic is used to apply security engineering, vulnerability, threat, and risk analyses to digital systems. This is accomplished by creating and maintaining a common understanding of the systems being defended, the operations on those systems, actors using the systems, and the relationships and interactions between these elements.
display-order: -1

Model-based Policy Optimization
type: Class
subclass of: Model-based Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-MBPO
definition: Model-based policy optimization (MBPO) is a model-based, online, off-policy reinforcement learning algorithm. For more information on the different types of reinforcement learning agents
kb-article: ## References MBPO Agents. MathWorks. [Link](https://www.mathworks.com/help/reinforcement-learning/ug/mbpo-agents.html).

Model-based Reinforcement Learning
type: Class
subclass of: Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-MBRL
definition: Model-based Reinforcement Learning refers to learning optimal behavior indirectly by learning a model of the environment by taking actions and observing the outcomes that include the next state and the immediate reward. The models predict the outcomes of actions and are used in lieu of or in addition to interaction with the environment to learn optimal policies.
kb-article: ## References Model-Based Reinforcement Learning. In *Encyclopedia of Machine Learning*, pp. 642-644. Springer, 2010. [Link](https://link.springer.com/referenceworkentry/10.1007/978-0-387-30164-8_556#:~:text=Model%2Dbased%20Reinforcement%20Learning%20refers,state%20and%20the%20immediate%20reward).

Model-based Value Iteration
type: Class
subclass of: Model-based Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-MBVI
definition: Value Iteration effectively reducesthe evaluation stage down to a single sweep of the states. Additionally, to improve things further, it combines the Policy Evaluation and Policy Improvement stages into a single update.
kb-article: ## References Policy and Value Iteration. Towards Data Science. [Link](https://towardsdatascience.com/policy-and-value-iteration-78501afb41d2).
synonym: MBVI

Model-free Reinforcement Learning
type: Class
subclass of: Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-MFRL
kb-article: ## References Model-free (reinforcement learning). Wikipedia. [Link](https://en.wikipedia.org/wiki/Model-free_(reinforcement_learning)).)
definition: In reinforcement learning (RL), a model-free algorithm (as opposed to a model-based one) is an algorithm which does not use the transition probability distribution (and the reward function) associated with the Markov decision process (MDP),which, in RL, represents the problem to be solved. The transition probability distribution (or transition model) and the reward function are often collectively called the "model" of the environment (or MDP), hence the name "model-free". A model-free RL algorithm can be thought of as an "explicit" trial-and-error algorithm. An example of a model-free algorithm is Q-learning.

Modem
type: Class
subclass of: Computer Network Node
definition: A modem -- a portmanteau of "modulator-demodulator" -- is a hardware device that converts data into a format suitable for a transmission medium so that it can be transmitted from one computer to another (historically along telephone wires). A modem modulates one or more carrier wave signals to encode digital information for transmission and demodulates signals to decode the transmitted information. The goal is to produce a signal that can be transmitted easily and decoded reliably to reproduce the original digital data. Modems can be used with almost any means of transmitting analog signals from light-emitting diodes to radio. A common type of modem is one that turns the digital data of a computer into modulated electrical signal for transmission over telephone lines and demodulated by another modem at the receiver side to recover the digital data.

Moments
type: Class
subclass of: Distribution Properties
type: NamedIndividual
d3fend-id: D3A-MOM
kb-article: ## References Wikipedia. (n.d.). Moment (mathematics). [Link](https://en.wikipedia.org/wiki/Moment_(mathematics))
definition: With a probability distribution function, the the first moment is the expected value, the second central moment is the variance, the third standardized moment is the skewness, and the fourth standardized moment is the kurtosis.

Mouse Input Device
type: Class
subclass of: Input Device
definition: A computer mouse (plural mice or mouses) is a hand-held pointing device that detects two-dimensional motion relative to a surface. This motion is typically translated into the motion of a pointer on a display, which allows a smooth control of the graphical user interface of a computer. In addition to moving a cursor, computer mice have one or more buttons to allow operations such as selection of a menu item on a display. Mice often also feature other elements, such as touch surfaces and scroll wheels, which enable additional control and dimensional input.
alternative label: Computer Mouse

Move File
type: Class
subclass of: System Call
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
type: NamedIndividual
modifies: File System Metadata
definition: A system call to rename or move a file. Linux's rename() is an example of this kind of system call. Another way of handling it is to call a copy file system call followed by a delete file system call.
alternative label: Rename File

Moving Average Model
type: Class
subclass of: Time Series Analysis
type: NamedIndividual
d3fend-id: D3A-MAM
kb-article: ## Refrences Wikipedia. (n.d.). Moving average model. [Link](https://en.wikipedia.org/wiki/Moving_average_model)
definition: the moving-average model (MA model) is an approach for modeling univariate time series and specifies that the output variable is cross-correlated with a non-identical to itself random-variable.
synonym: MA Model

Multi-factor Authentication
type: Class
subclass of: Agent Authentication
subclass of: Restriction
  on property: uses
  some values from: Credential
type: NamedIndividual
kb-reference: Reference-MethodAndApparatusForUtilizingATokenForResourceAccess RsaSecurityInc.
uses: Credential
d3fend-id: D3-MFA
kb-article: ## How it works When logging into an account users present two or more credentials that fall into different categories: something you know (password or PIN), something you have (smart card or phone), or something you are (fingerprint). ## Considerations MFA configuration steps may vary across accounts and in some cases left up to users to activate and implement.
definition: Requiring proof of two or more pieces of evidence in order to authenticate a user.

Multiclass Classification
type: Class
subclass of: Classifying

Multilayer Perceptron Classification
type: Class
subclass of: Artificial Neural Network Classification
type: NamedIndividual
d3fend-id: D3A-MPC
definition: A multilayer perceptron (MLP) is a fully connected class of feedforward artificial neural network (ANN).An MLP consists of at least three layers of nodes: an input layer, a hidden layer and an output layer.
kb-article: ## References Multilayer perceptron. Wikipedia. [Link](https://en.wikipedia.org/wiki/Multilayer_perceptron).

Multimedia Document File
type: Class
subclass of: Document File
definition: Digital video files which often contain audio.

Multimedia File
type: Class
subclass of: File
subclass of: Restriction
  on property: contains
  some values from: Digital Multimedia
type: NamedIndividual
contains: Digital Multimedia
definition: A file that contains digital multimedia.

Multiple Regression
type: Class
subclass of: Regression Analysis
type: NamedIndividual
d3fend-id: D3A-MR
definition: Multiple (linear) regression attempts to model the relationship between two or more explanatory variables and a response variable by fitting a linear equation to observed data.
synonym: Multiple Linear Regression
kb-article: ## References Yale University Department of Statistics. (1997-98). Linear regression and multivariate analysis. [Link](http://www.stat.yale.edu/Courses/1997-98/101/linmult.htm)

Multiple Regression Learning
type: Class
subclass of: Regression Analysis Learning
type: NamedIndividual
d3fend-id: D3A-MRL
definition: A supervised learning method that builds a multiple regression model using training data.
kb-article: ## References Yale University Department of Statistics. (1997-98). Linear regression and multivariate analysis. [Link](http://www.stat.yale.edu/Courses/1997-98/101/linmult.htm)

Multivariate Analysis
type: Class
subclass of: Statistical Method
type: NamedIndividual
d3fend-id: D3A-MA
kb-article: ## References Wikipedia. (n.d.). Multivariate statistics. [Link](https://en.wikipedia.org/wiki/Multivariate_statistics)
definition: Multivariate statistics encompassed the simultaneous observation and analysis of more than one outcome variable, i.e., multivariate random variables.

NIST Control
type: Class
subclass of: External Control
subclass of: Restriction
  on property: member-of
  some values from: NIST SP 800-53 Control Catalog

NIST SP 800-53 Control Catalog
type: Class
subclass of: Control Catalog
subclass of: Restriction
  on property: has-member
  some values from: NIST Control
definition: A NIST SP 800-53 control catalog provides the entire set of security and privacy controls for a version of NIST SP 800-53.

NTFS Hard Link
type: Class
subclass of: Hard Link
subclass of: NTFS Link
definition: An NTFS hard link points to another file, and files share the same MFT entry (inode), in the same filesystem.

NTFS Junction Point
type: Class
subclass of: NTFS Link
subclass of: Symbolic Link
definition: NTFS junction points are are similar to NTFS symlinks but are defined only for directories. Only accepts local absolute paths.
alternative label: Junction Point

NTFS Link
type: Class
subclass of: File
subclass of: File System Link
definition: The NTFS filesystem defines various ways to link files, i.e. to make a file point to another file or its contents. The object being pointed to is called the target. There are three classes of NTFS links: (a) Hard links, which have files share the same MFT entry (inode), in the same filesystem; (b) Symbolic links, which record the path of another file that the links contents should show and can accept relative paths; and (c) Junction points, which are similar to symlinks but defined only for directories and only accepts local absolute paths

NTFS Symbolic Link
type: Class
subclass of: NTFS Link
subclass of: Symbolic Link
definition: An NTFS symbolic link records the path of another file that the links contents should show. Can accept relative paths. SMB networking (UNC path) and directory support added in NTFS 3.1.
alternative label: NTFS Symlink

NTP Broadcast Event
type: Class
subclass of: NTP Event
definition: An event where an NTP server broadcasts time synchronization messages to multiple clients simultaneously, enabling synchronization without individual request-response cycles.

NTP Client Synchronization Event
type: Class
subclass of: NTP Event
definition: An event where an NTP client requests and adjusts its clock based on time synchronization data provided by an NTP server, ensuring alignment with a standard time source.

NTP Control Message Event
type: Class
subclass of: NTP Event
definition: An event where an NTP client or server exchanges control messages used for diagnostic, monitoring, or administrative management of the NTP protocol, rather than time synchronization.

NTP Event
type: Class
subclass of: Application Layer Event
subclass of: UDPEvent
subclass of: Restriction
  on property: has-participant
  some values from: Network Time Server
definition: An event involving the Network Time Protocol (NTP), a protocol designed to synchronize the clocks of computer systems over packet-switched, variable-latency data networks, UDP as its transport protocol.

NTP Server Response Event
type: Class
subclass of: NTP Event
subclass of: Restriction
  on property: preceded-by
  some values from: NTP Client Synchronization Event
definition: An event where an NTP server sends time synchronization data to a client, enabling the client to align its local clock with the server's reference time.

NTP Symmetric Active Exchange Event
type: Class
subclass of: NTP Event
definition: An event where an NTP peer operating in symmetric active mode initiates clock synchronization messages to a peer in symmetric passive mode, enabling time synchronization between equal-status systems.

NTP Symmetric Passive Exchange Event
type: Class
subclass of: NTP Event
subclass of: Restriction
  on property: preceded-by
  some values from: NTP Symmetric Active Exchange Event
definition: An event where an NTP peer operating in symmetric passive mode responds to clock synchronization messages initiated by a symmetric active peer, facilitating mutual timekeeping.

Naive Bayes Classifier
type: Class
subclass of: Classification
type: NamedIndividual
d3fend-id: D3A-NBC
kb-article: ## References Naive Bayes. IBM. [Link](https://www.ibm.com/topics/naive-bayes?mhsrc=ibmsearch_a&mhq=naive%20bayes).
definition: The Naïve Bayes classifier is a supervised machine learning algorithm, which is used for classification tasks, like text classification. It is also part of a family of generative learning algorithms, meaning that it seeks to model the distribution of inputs of a given class or category.

Named Pipe
type: Class
subclass of: Pipe
type: NamedIndividual
definition: In computing, a named pipe (also known as a FIFO for its behavior) is an extension to the traditional pipe concept on Unix and Unix-like systems, and is one of the methods of inter-process communication (IPC). The concept is also found in OS/2 and Microsoft Windows, although the semantics differ substantially. A traditional pipe is 'unnamed' and lasts only as long as the process. A named pipe, however, can last as long as the system is up, beyond the life of the process. It can be deleted if no longer used. Usually a named pipe appears as a file, and generally processes attach to it for IPC.

Network
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A network is a group of computers that use a set of common communication protocols over digital interconnections for the purpose of sharing resources located on or provided by the network nodes. The interconnections between nodes are formed from a broad spectrum of telecommunication network technologies, based on physically wired, optical, and wireless radio-frequency methods that may be arranged in a variety of network topologies.
alternative label: Computer Network

Network Access Mediation
type: Class
subclass of: Access Mediation
subclass of: Restriction
  on property: isolates
  some values from: Network
type: NamedIndividual
isolates: Network
kb-reference: Reference-WhatIsNetworkAccessControl
d3fend-id: D3-NAM
kb-article: ## How it works Network Access Mediation is a crucial process in telecommunications and IT networks that involves controlling access to network resources. It acts as an intermediary layer between network access requests and the actual network resources, ensuring that only authorized users and devices can access the network.
definition: Network access mediation is the control method for authorizing access to a system by a user (or a process acting on behalf of a user) communicating through a network, including a local area network, a wide area network, and the Internet.
synonym: Network Access Control

Network Agent
type: Class
subclass of: Software
type: NamedIndividual
synonym: Exporter
definition: A network agent is software installed on a network node or device that transmits information back to a collector agent or management system. Kinds of network agents include SNMP Agent, IPMI agents, WBEM agents, and many proprietary agents capturing network monitoring and management information.

Network Audio Streaming Resource
type: Class
subclass of: Network Media Streaming Resource
definition: A server that provides digital audio media content to users.

Network Audio Visual Streaming Resource
type: Class
subclass of: Network Multimedia Streaming Resource
definition: A server that provides digital audio-visual media content to users.

Network Card Firmware
type: Class
subclass of: Peripheral Firmware
definition: Firmware that is installed on a network card (network interface controller).
alternative label: Network Controller Firmware

Network Connection Close Event
type: Class
subclass of: Network Connection Event
subclass of: Restriction
  on property: preceded-by
  some values from: Network Connection Open Event
definition: An event where a network connection is closed.

Network Connection Event
type: Class
subclass of: Network Event
subclass of: Restriction
  on property: has-participant
  some values from: Network Session
definition: An event related to the establishment, maintenance, or termination of a network connection.

Network Connection Fail Event
type: Class
subclass of: Network Connection Event
definition: An event where a network connection attempt fails.

Network Connection Listen Event
type: Class
subclass of: Network Connection Event
definition: An event where a network endpoint begins listening for new network connections.

Network Connection Open Event
type: Class
subclass of: Network Connection Event
definition: An event where a network connection is successfully opened.

Network Connection Refuse Event
type: Class
subclass of: Network Connection Event
definition: An event where a network connection is refused.

Network Connection Reset Event
type: Class
subclass of: Network Connection Event
subclass of: Restriction
  on property: preceded-by
  some values from: Network Connection Open Event
definition: An event where an attempt is made to establish a network connection.

Network Device Event
type: Class
subclass of: Hardware Device Event
definition: An event capturing the activity or state of network devices, such as Ethernet adapters, Wi-Fi modules, or virtual interfaces. These events highlight connectivity, configuration, or performance changes.

Network Directory Resource
type: Class
subclass of: Network File Share Resource
subclass of: Restriction
  on property: contains
  some values from: Directory
type: NamedIndividual
contains: Directory
definition: A directory resource made available from one host to other hosts on a computer network.

Network Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Network Traffic
definition: An event involving network communications within or between digital systems.

Network File Resource
type: Class
subclass of: Network File Share Resource
subclass of: Restriction
  on property: contains
  some values from: File
type: NamedIndividual
contains: File
definition: A computer file resource made available from one host to other hosts on a computer network.

Network File Share Resource
type: Class
subclass of: Network Resource
type: NamedIndividual
definition: A shared file resource, or network file share, is a computer file made available from one host to other hosts on a computer network. Network sharing is made possible by inter-process communication over the network. It includes both files and directories.

Network Flow
type: Class
subclass of: Digital Information
subclass of: Restriction
  on property: summarizes
  some values from: Network Traffic
type: NamedIndividual
summarizes: Network Traffic
definition: A summarization of network transactions between a client and server. It often summarizes bytes sent, bytes received, and protocol flags.

Network Flow Sensor
type: Class
subclass of: Network Sensor
subclass of: Restriction
  on property: monitors
  some values from: Network Flow
type: NamedIndividual
monitors: Network Flow
definition: Monitors network traffic and produces summaries of data flows traversing the network.

Network Frame
type: Class
subclass of: Digital Information Bearer
definition: A finite, self-delimited sequence of bits exchanged as one unit over a single data link. Formed by link-layer encapsulation, a frame typically begins with synchronization and control fields, carries a payload, ends with an integrity check, and is bounded from adjacent frames by explicit timing or delimiter symbols.
alternative label: Frame

Network Init Script File Resource
type: Class
subclass of: Init Script
subclass of: Network File Resource
type: NamedIndividual
definition: A computer file resource made available from one host to other hosts on a computer network that is also an initialization script.

Network Interface Card
type: Class
subclass of: Hardware Device
type: NamedIndividual
synonym: Network Interface Controller
definition: A network interface card (NIC, also known as a network interface controller, network adapter, LAN adapter or physical network interface, and by similar terms) is a computer hardware component that connects a computer to a computer network.

Network Isolation
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Isolate
type: NamedIndividual
enables: Isolate
d3fend-id: D3-NI
definition: Network Isolation techniques prevent network hosts from accessing non-essential system network resources.

Network Link
type: Class
subclass of: Logical Link
definition: A network link is a link within the network layer, which is responsible for packet forwarding including routing through intermediate routers.
synonym: Layer-3 Link
synonym: Network Layer Link

Network Mapping
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Model
type: NamedIndividual
enables: Model
d3fend-id: D3-NM
definition: Network mapping encompasses the techniques to identify and model the physical layer, network layer, and data exchange layers of the organization's network and their physical location, and determine allowed pathways through that network.
display-order: 3

Network Media Streaming Resource
type: Class
subclass of: Network Resource
definition: A server that provides digital media content to users.

Network Multimedia Streaming Resource
type: Class
subclass of: Network Media Streaming Resource
definition: A server that provides digital multimedia content to users.

Network Node
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: In telecommunications networks, a node (Latin nodus, 'knot') is either a redistribution point or a communication endpoint. The definition of a node depends on the network and protocol layer referred to. A physical network node is an electronic device that is attached to a network, and is capable of creating, receiving, or transmitting information over a communications channel. A passive distribution point such as a distribution frame or patch panel is consequently not a node.

Network Node Inventory
type: Class
subclass of: Asset Inventory
subclass of: Restriction
  on property: inventories
  some values from: Network Node
type: NamedIndividual
inventories: Network Node
kb-reference: Reference-IEEE-802 1AB-2016
kb-reference: Reference-QualysNetworkPassiveSensorGettingStartedGuide
kb-reference: Reference-RFC3411-AnArchitectureForDescribingSimpleNetworkManagementProtocolSNMPManagementFrameworks
kb-reference: Reference-Web-BasedEnterpriseManagement
kb-reference: Reference-Windows-Management-Infrastructure
kb-reference: Reference-Windows-Management-Instrumentation
d3fend-id: D3-NNI
kb-article: ## How it works Administrators collect information on network nodes in their architecture using a variety of administrative and management tools that query network devices and nodes for information. In some cases, where such queries are not supported or provide specific information of interest, an administrator may also collect this information through network enumeration methods to include host discovery and scanning for active ports and services. ## Considerations * Scanning and probing techniques using mapping tools can result in side effects to information technology (IT) and operational technology (OT) systems. * An adversary conducting network enumeration may engage in activities that parallel normal network node inventorying activities, but would require escalating to admin privileges for most of the operations requiting administrative tools ## Examples * Link-layer discovery * Link-layer Discovery Protocol (LLDP) * Cisco Discovery Protocol (CDP) * Application-layer discovery * Simple Network Management Protocol (SNMP) collects MIB information * Web-based Enterprise Management (WBEM) collects CIM information * Windows Management Instrumentation (WMI) * Windows Management Infrastructure (MI)
synonym: System Discovery
synonym: System Inventorying
definition: Network node inventorying identifies and records all the network nodes (hosts, routers, switches, firewalls, etc.) in the organization's architecture.

Network Packet
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A network packet is a formatted unit of data carried by a packet-switched network. Computer communications links that do not support packets, such as traditional point-to-point telecommunications links, simply transmit data as a bit stream. When data is formatted into packets, packet switching is possible and the bandwidth of the communication medium can be better shared among users than with circuit switching.

Network Printer
type: Class
subclass of: Shared Computer
definition: In computing, a network printer is a device that can be accessed over a network which makes a persistent representation of graphics or text, usually on paper. While most output is human-readable, bar code printers are an example of an expanded use for printers. The different types of printers include 3D printer, inkjet printer, laser printer, thermal printer, etc. Note that not all printers are networked and the digital information to be printed must be passed either by removable media or as directly connecting the printer to a computer (e.g., by USB.)

Network Protocol Analyzer
type: Class
subclass of: Network Sensor
subclass of: Restriction
  on property: monitors
  some values from: Network Traffic
type: NamedIndividual
monitors: Network Traffic
definition: Monitors and parses network protocols to extract values from various network protocol layers.

Network Resource
type: Class
subclass of: Remote Resource
type: NamedIndividual
definition: In computing, a shared resource, or network share, is a computer resource made available from one host to other hosts on a computer network. It is a device or piece of information on a computer that can be remotely accessed from another computer, typically via a local area network or an enterprise intranet, transparently as if it were a resource in the local machine.Network sharing is made possible by inter-process communication over the network.
alternative label: Shared Resource

Network Resource Access
type: Class
subclass of: Resource Access
subclass of: Restriction
  on property: accesses
  some values from: Network Resource
subclass of: Restriction
  on property: accesses
  some values from: Resource
type: NamedIndividual
accesses: Network Resource
accesses: Resource
definition: Ephemeral digital artifact comprising a request of a network resource and any response from that network resource.

Network Resource Access Mediation
type: Class
subclass of: Access Mediation
subclass of: Restriction
  on property: isolates
  some values from: Network Resource
type: NamedIndividual
isolates: Network Resource
kb-reference: Reference-NIST-Special-Publication-800-53-Revision-5
d3fend-id: D3-NRAM
definition: Control of access to organizational systems and services by users or processes over a network.
kb-article: ## How it works Network Resource Access Control involves managing and regulating access to resources within an organization's network. This includes ensuring that only authorized users or processes can access specific systems or data, often through authentication and authorization mechanisms. Examples include accessing internal databases, file servers, or application services.
synonym: Remote Access Control

Network Scanner
type: Class
subclass of: Cyber Sensor
subclass of: Restriction
  on property: monitors
  some values from: Network
type: NamedIndividual
monitors: Network
alternative label: Network Enumerator
definition: A network scanner is a computer program used to retrieve usernames and info on groups, shares, and services of networked computers. This type of program scans networks for vulnerabilities in the security of that network. If there is a vulnerability with the security of the network, it will send a report back to a hacker who may use this info to exploit that network glitch to gain entry to the network or for other malicious activities. Ethical hackers often also use the information to remove the glitches and strengthen their network.

Network Sensor
type: Class
subclass of: Cyber Sensor
definition: A Network Sensor monitors network traffic and communication patterns.

Network Service
type: Class
subclass of: Service Application Process
definition: In computer networking, a network service is an application running at the network application layer and above, that provides data storage, manipulation, presentation, communication or other capability which is often implemented using a client-server or peer-to-peer architecture based on application layer network protocols. Clients and servers will often have a user interface, and sometimes other hardware associated with it.

Network Session
type: Class
subclass of: Session
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
type: NamedIndividual
produces: Network Traffic
definition: A network session is a temporary and interactive information interchange between two or more devices communicating over a network. A session is established at a certain point in time, and then 'torn down' - brought to an end - at some later point. An established communication session may involve more than one message in each direction. A session is typically stateful, meaning that at least one of the communicating parties needs to hold current state information and save information about the session history in order to be able to communicate, as opposed to stateless communication, where the communication consists of independent requests with responses. Network sessions may be established and implemented as part of protocols and services at the application, session, or transport layers of the OSI model.

Network Time Server
type: Class
subclass of: Server
definition: A network time server is a server computer that reads the actual time from a reference clock and distributes this information to its clients using a computer network. The time server may be a local network time server or an internet time server. The time server may also be a stand-alone hardware device. It can use NTP (RFC5905) or other protocols.

Network Traffic
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Network Packet
subclass of: Restriction
  on property: may-contain
  some values from: Domain Name
subclass of: Restriction
  on property: originates-from
  some values from: Physical Location
type: NamedIndividual
contains: Network Packet
may-contain: Domain Name
originates-from: Physical Location
definition: Network traffic or data traffic is the data, or alternatively the amount of data, moving across a network at a given point of time. Network data in computer networks is mostly encapsulated in network packets, which provide the load in the network.
alternative label: Data Traffic

Network Traffic Analysis
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Detect
type: NamedIndividual
enables: Detect
d3fend-id: D3-NTA
definition: Analyzing intercepted or summarized computer network traffic to detect unauthorized activity.

Network Traffic Analysis Software
type: Class
subclass of: Developer Application
type: NamedIndividual
type: Digital Artifact
alternative label: Network Sniffer
definition: A packet analyzer, also known as packet sniffer, protocol analyzer, or network analyzer, is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network.

Network Traffic Community Deviation
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
type: NamedIndividual
analyzes: Network Traffic
kb-reference: Reference-SystemForImplementingThreatDetectionUsingDailyNetworkTrafficCommunityOutliers VECTRANETWORKSInc
d3fend-id: D3-NTCD
definition: Establishing baseline communities of network hosts and identifying statistically divergent inter-community communication.
kb-article: ## How it works Hosts/users within a computer network are analyzed to identify communities of hosts which frequently communicate. Future communications between communities that don't usually communicate can then be detected. For example, if a community of hosts that communicate in support of a company's finance division suddenly starts to access the code server usually accessed only by engineers, this may indicate unauthorized activity. ## Considerations * Potential for false positives in very dynamic network environments. * Attackers that move low and slow may not differentiate their behavior enough to trigger an alert.

Network Traffic Filtering
type: Class
subclass of: Network Isolation
subclass of: Restriction
  on property: filters
  some values from: Network Traffic
type: NamedIndividual
filters: Network Traffic
kb-reference: Reference-ActiveFirewallSystemAndMethodology McAfeeLLC
kb-reference: Reference-AutomaticallyGeneratingRulesForConnectionSecurity Microsoft
kb-reference: Reference-FWTK-FirewallToolkit
kb-reference: Reference-FirewallForInterentAccess SecureComputingLLC
kb-reference: Reference-FirewallForProcessingAConnectionlessNetworkPacket NationalSecurityAgency
kb-reference: Reference-FirewallForProcessingConnection-orientedAndConnectionlessDatagramsOverAConnection-orientedNetwork NationalSecurityAgency
kb-reference: Reference-FirewallsThatFilterBasedUponProtocolCommands IntelCorp
kb-reference: Reference-MethodForControllingComputerNetworkSecurity CheckpointSoftwareTechnologiesLtd
kb-reference: Reference-NetworkFirewallWithProxy SecureComputingLLC
d3fend-id: D3-NTF
definition: Restricting network traffic originating from any location.

Network Traffic Policy Mapping
type: Class
subclass of: Network Mapping
subclass of: Restriction
  on property: maps
  some values from: Access Control Configuration
subclass of: Restriction
  on property: queries
  some values from: Network Agent
type: NamedIndividual
maps: Access Control Configuration
queries: Network Agent
d3fend-id: D3-NTPM
synonym: Web Security Gateway Policy Mapping
synonym: Firewall Mapping
definition: Network traffic policy mapping identifies and models the allowed pathways of data at the network, transport, and/or application levels.
synonym: DLP Policy Mapping
synonym: IPS Policy Mapping

Network Traffic Signature Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
type: NamedIndividual
analyzes: Network Traffic
kb-reference: Reference-SystemAndMethodForStrategicAntiMalwareMonitoring
d3fend-id: D3-NTSA
definition: Analyzing network traffic and compares it to known signatures
kb-article: ## How it works Network signature analysis relies on predefined patterns, or signatures, to identify malicious network activity. These signatures typically match against specific byte sequences, packet header information, or protocol anomalies indicative of known threats. The process works as follows: * Packet Capture: Network traffic is captured on an interface or port, resulting in a stream of raw packets. * Preprocessing: The captured packets are preprocessed, cleaning and normalizing the data for efficient analysis. * Signature Matching: Each packet is compared against a database of signatures using dedicated engines. ## Considerations ### False Negatives Network signature analysis is susceptible to generating false negatives. These occur when malicious activity evades detection due to limitations in the signature-based approach. Here are some common causes: * Evolving threats: Attackers frequently modify their tactics, rendering existing signatures ineffective against new variants. * Obfuscation: Attackers may disguise malicious content using encryption, encoding, or other techniques to bypass signature detection. * Limited visibility: Signatures rely on specific patterns. If crucial information is encrypted or hidden, the signature might miss the threat. * Zero-day attacks: By definition, new and unknown attacks lack corresponding signatures, allowing them to pass undetected. ### False Positives Network signature analysis is susceptible to generating false positives. These occur when the signature analysis triggers an alert for benign traffic. Common causes include: * Overly broad signatures: Rules designed to be too general might match harmless activities, generating false alarms. * Network misconfigurations: Improperly configured devices or legitimate network activity can mimic malicious patterns, triggering false positives. * Data errors: Corrupted or incomplete network data can lead to misinterpretations and false alerts.

Network Video Streaming Resource
type: Class
subclass of: Network Media Streaming Resource
definition: A server that provides digital video media content to users.

Network Vulnerability Assessment
type: Class
subclass of: Network Mapping
subclass of: Restriction
  on property: evaluates
  some values from: Network
subclass of: Restriction
  on property: identifies
  some values from: Vulnerability
type: NamedIndividual
evaluates: Network
identifies: Vulnerability
kb-reference: Reference-ReachabilityGraphBasedSafeRemediationsforSecuirytofOnPremiseAndCloudComputingEnvironments
d3fend-id: D3-NVA
definition: Network vulnerability assessment relates all the vulnerabilities of a network's components in the context of their configuration and interdependencies and can also include assessing risk emerging from the network's design as a whole, not just the sum of individual network node or network segment vulnerabilities.

Non-Parametric Tests
type: Class
subclass of: Hypothesis Testing
type: NamedIndividual
d3fend-id: D3A-NPT
kb-article: ## References Newcastle University. (n.d.). Parametric Hypothesis Tests. [Link](https://www.ncl.ac.uk/webtemplate/ask-assets/external/maths-resources/psychology/non-parametric-hypothesis-tests.html)
definition: A non-parametric test relies is used when the underlying distribution of data is non-symmetric (non-normal distribution).

Non-Person Entity
type: Class
subclass of: Agent
definition: An entity related to information technology with a digital identity that acts in cyberspace, but is not a human actor. This can include organizations, hardware objects (physical entities/devices), software objects (virtual/logical entities), and information artifacts.
synonym: NPE

Non-monotonic Logic
type: Class
subclass of: Symbolic AI
type: NamedIndividual
d3fend-id: D3A-NML
definition: Non-monotonic logic is a formal logic whose conclusion relation is not monotonic. In other words, non-monotonic logics are devised to capture and represent defeasible inferences (cf. defeasible reasoning), i.e., a kind of inference in which reasoners draw tentative conclusions, enabling reasoners to retract their conclusion(s) based on further evidence.
kb-article: ## References 1. Non-monotonic logic. (2023, June 1). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Non-monotonic_logic)

Nonlinear Regression
type: Class
subclass of: Regression Analysis
type: NamedIndividual
d3fend-id: D3A-NR
definition: Nonlinear regression is a form of regression analysis in which observational data are modeled by a function which is a nonlinear combination of the model parameters and depends on one or more independent variables.
kb-article: ## References Wikipedia. (n.d.). Nonlinear regression. [Link](https://en.wikipedia.org/wiki/Nonlinear_regression)

Nonlinear Regression Learning
type: Class
subclass of: Regression Analysis Learning
type: NamedIndividual
d3fend-id: D3A-NRL
kb-article: ## References Wikipedia. (n.d.). Nonlinear regression. [Link](https://en.wikipedia.org/wiki/Nonlinear_regression)
definition: A supervised learning method that builds a non-linear regression model using training data.

Null Pointer Checking
type: Class
subclass of: Pointer Validation
subclass of: Restriction
  on property: hardens
  some values from: Memory Free Function
subclass of: Restriction
  on property: hardens
  some values from: Pointer Dereferencing Function
type: NamedIndividual
hardens: Memory Free Function
hardens: Pointer Dereferencing Function
kb-reference: Reference-NullPointerChecking SEI
kb-reference: Reference-NullPointerDereference CWE
kb-reference: Reference-PointerValidationFunction SEI
d3fend-id: D3-NPC
definition: Checking if a pointer is NULL.
kb-article: ## How it Works Programmatically checking if a pointer is NULL before use. ## Considerations * Pointers should be checked prior to use after they have, or may have been modified. * Note that it may vary by circumstance whether the caller, or callee is responsible for checking if a pointer is NULL. * Note: This resource should not be considered a definitive or exhaustive coding guideline.
synonym: Nil Pointer Checking

Numeric Pattern Matching
type: Class
subclass of: Pattern Matching
type: NamedIndividual
d3fend-id: D3A-NPM
definition: Numeric pattern matching uses a pattern specification and sees if the numeric value matches that pattern--simple forms include exact matching and range matching.

OS API Access Process
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Access Process
type: NamedIndividual
invokes: Access Process
definition: An OS API function for interacting with processes.

OS API Allocate Memory
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Allocate Memory
type: NamedIndividual
invokes: Allocate Memory
definition: An OS API function that requests and allocates a region of memory for use by a process or application.

OS API Connect Socket
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Connect Socket
type: NamedIndividual
invokes: Connect Socket
definition: An OS API function that establishes a connection between a socket and a endpooint.

OS API Copy Token
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Copy Token
type: NamedIndividual
invokes: Copy Token
definition: An OS API function that creates a duplicate or copy of an existing security token.

OS API Create File
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Create File
type: NamedIndividual
invokes: Create File
definition: An OS API function that creates a file.

OS API Create Process
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Create Process
type: NamedIndividual
invokes: Create Process
definition: An OS API function that creates a new process within the system.

OS API Create Socket
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Create Socket
type: NamedIndividual
invokes: Create Socket
definition: An OS API function that creates a socket.

OS API Create Thread
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Create Thread
type: NamedIndividual
invokes: Create Thread
definition: An OS API function that creates a new thread of execution within a process.

OS API Delete File
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Delete File
type: NamedIndividual
invokes: Delete File
definition: An OS API function that removes a file from the file system.

OS API Exec
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Exec
type: NamedIndividual
invokes: Exec
definition: An OS API function that replaces the current process image with a new processs image, executing a specified program.

OS API Free Memory
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Free Memory
type: NamedIndividual
invokes: Free Memory
definition: An OS API function that releases or deallocates memory that was previously allocated by the program.

OS API Function
type: Class
subclass of: Software
definition: A callable interface provided by an operating system that allows applications or other software components to interact with and utilize the underlying system resources, services, or functionalities.

OS API Get System Time
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Get System Time
type: NamedIndividual
invokes: Get System Time
definition: An OS API function that retrieves the current system time or timestamp.

OS API Get Thread Context
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Get Thread Context
type: NamedIndividual
invokes: Get Thread Context
definition: An OS API function that retrieves the execution context or state of a specific thread in a process.

OS API Load Module
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Load Module
type: NamedIndividual
invokes: Load Module
definition: An OS API function that loads a module into memory and makes it available for execution.

OS API Move File
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Move File
type: NamedIndividual
invokes: Move File
definition: An OS API function that moves or renames a file or directory from one location to another within the file system.

OS API Open File
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Open File
type: NamedIndividual
invokes: Open File
definition: An OS API function that opens a file for reading, writing, or both, and return a handle or descriptor that can be used to interact with the file.

OS API Read File
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Read File
type: NamedIndividual
invokes: Read File
definition: An OS API function that reads data from a file or input stream into memory.

OS API Read Memory
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Read Memory
type: NamedIndividual
invokes: Read Memory
definition: An OS API function that reads the contents of memory from a specific address or region.

OS API Resume Process
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Resume Process
type: NamedIndividual
invokes: Resume Process
definition: An OS API function that resumes the execution of a paused, stopped, or suspended process.

OS API Resume Thread
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Resume Thread
type: NamedIndividual
invokes: Resume Thread
definition: An OS API function that resumes the execution of a paused, stopped, or suspended thread.

OS API Save Registers
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Save Registers
type: NamedIndividual
invokes: Save Registers
definition: An OS API function that retrieves and saves the values of CPU registers for a specific process or thread.

OS API Set Registers
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Set Registers
type: NamedIndividual
invokes: Set Registers
definition: An OS API function that modifies the values of CPU registers.

OS API Set Thread Context
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Set Thread Context
type: NamedIndividual
invokes: Set Thread Context
definition: An OS API function that modifies the execution context of a thread.

OS API Suspend Process
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Suspend Process
type: NamedIndividual
invokes: Suspend Process
definition: An OS API function that pauses the execution of a process.

OS API Suspend Thread
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Suspend Thread
type: NamedIndividual
invokes: Suspend Thread
definition: An OS API function that pauses the execution of a thread.

OS API System Function
type: Class
subclass of: OS API Function
definition: Indirect System calls are made through an OS-specific library (like glibc in Linux) that provides a higher-level API for the system calls.
synonym: Indirect System Call

OS API Terminate Process
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Terminate Process
type: NamedIndividual
invokes: Terminate Process
see also: An OS API function taht stops the execution of a process.

OS API Trace Process
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Trace Process
type: NamedIndividual
invokes: Trace Process
definition: An OS API function that enables a program to monitor, control, or interact with the execution of a process.

OS API Trace Thread
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: Trace Thread
type: NamedIndividual
invokes: Trace Thread
definition: An OS API function that enables a program to monitor, control, or interact with the execution of a thread.

OS API Unload Module
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: UnloadModule
type: NamedIndividual
invokes: UnloadModule
definition: An OS API function that removes a previously loaded module from memory.

OS API Write File
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: WriteFile
type: NamedIndividual
invokes: WriteFile
definition: An OS API function that writes data from a buffer in memory to a file or output stream.

OS API Write Memory
type: Class
subclass of: OS API System Function
subclass of: Restriction
  on property: invokes
  some values from: WriteMemory
type: NamedIndividual
invokes: WriteMemory
definition: An OS API function that writes data into the memory space of another process or into specific regions of memory.

OT Abort Command
type: Class
subclass of: OT Modify Device Operating Mode Command
subclass of: Restriction
  on property: modifies
  some values from: Operating Mode
type: NamedIndividual
modifies: Operating Mode
definition: Commands a device to abort a service/program.
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)

OT Abort Command Event
type: Class
subclass of: OT Modify Device Operating Mode Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Abort Command
subclass of: Restriction
  on property: has-participant
  some values from: Operating Mode
subclass of: Restriction
  on property: preceded-by
  some values from: OT Run Command Event

OT Actuator
type: Class
subclass of: Actuator
type: NamedIndividual
definition: An OT actuator is an industrial-grade actuator optimized for operational technology (OT) environments, such as SCADA or process-control systems. It tolerates harsher conditions, meets stricter safety and reliability standards, and integrates seamlessly with ICS protocols to enable real-time mechanical motion or adjustments in production lines and critical infrastructure.

OT Alarm Message
type: Class
subclass of: OT Diagnostics Message
definition: Report danger, hazards, or serious errors.
comment: BACnet: acknowledgeAlarm BACnet: confirmedEventNotification BACnet: getAlarmSummary BACnet: unconfirmedEventNotification BACnet: lifeSafetyOperation BACnet: Abort: 1 BACnet: Abort: 2 BACnet: Abort: 3 BACnet: Abort: 4 BACnet: Abort: 5 BACnet: Abort: 6 BACnet: Abort: 7 BACnet: Abort: 8 BACnet: Abort: 9 BACnet: Abort: 10 BACnet: Abort: 11 BACnet: Abort: 12
comment: GE-SRTP: RETURN FAULT TABLE GE-SRTP: CLEAR FAULT TABLE

OT Alarm Message Event
type: Class
subclass of: OT Diagnostics Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Alarm Message
definition: Report danger, hazards, or serious errors.

OT Change Control Program Command
type: Class
subclass of: OT Modify Control Program Command
subclass of: Restriction
  on property: modifies
  some values from: OT Control Program
type: NamedIndividual
modifies: OT Control Program
definition: Commands a remote device to modify an existing control program.
comment: GE-SRTP: WRITE PROGRAM BLOCK MEMORY GE-SRTP: CHANGE PLC CPU PRIVILEGE LEVEL GE-SRTP: SET CONTROL ID(CPU ID) GE-SRTP: PROGRAM STORE (UPLOAD FROM PLC) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC) GE-SRTP: TOGGLE FORCE SYSTEM MEMORY

OT Change Control Program Command Event
type: Class
subclass of: OT Modify Control Program Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Change Control Program Command
subclass of: Restriction
  on property: has-participant
  some values from: OT Control Program
definition: Commands a remote device to modify an existing control program.

OT Change Data Command
type: Class
subclass of: OT Write Command
definition: OT command that modifies existing data on a remote device.
comment: BACnet: atomicWriteFile BACnet: writeProperty BACnet: writePropertyMultiple BACnet: write-group
comment: CIP: Set Attributes All CIP: Set Attribute List CIP: Set Attribute Single CIP: Set Member
comment: GE-SRTP: WRITE SYSTEM MEMORY GE-SRTP: WRITE TASK MEMORY
comment: Modbus: Write Single Coil Modbus: Write Single Register Modbus: Write Multiple Coils Modbus: Write Multiple Registers Modbus: Write File Record Modbus: Mask Write Register Modbus: Read Write Register

OT Change Data Command Event
type: Class
subclass of: OT Write Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Change Data Command
definition: OT command that modifies existing data on a remote device.

OT Connection Command
type: Class
subclass of: OT Network Management Command
definition: Establish a network connection with a device.
comment: BACnet: vtOpen BACnet: vtClose
comment: ENIP: Register Session ENIP: Unregister Session

OT Connection Command Event
type: Class
subclass of: OT Network Management Message Event
subclass of: Restriction
  on property: has-participant
  some values from: Network Traffic
subclass of: Restriction
  on property: has-participant
  some values from: OT Connection Command
definition: Establish a network connection with a device.

OT Control Command
type: Class
subclass of: OT Process Data Command
definition: Command and control the managed process.
comment: CIP: Reset CIP: Start CIP: Stop CIP: Create CIP: Delete CIP: Apply Attributes CIP: Restore CIP: Save
comment: GE-SRTP: PLC SHORT STATUS REQUEST

OT Control Command Event
type: Class
subclass of: OT Process Data Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Control Command
definition: Command and control the managed process.

OT Control Logic Process
type: Class
subclass of: Service Application Process
subclass of: Restriction
  on property: communicates-with
  some values from: OT I/O Module
subclass of: Restriction
  on property: contains
  some values from: OT Logic Variable
subclass of: Restriction
  on property: controls
  some values from: OT Actuator
subclass of: Restriction
  on property: monitors
  some values from: OT Sensor
type: NamedIndividual
communicates-with: OT I/O Module
contains: OT Logic Variable
controls: OT Actuator
monitors: OT Sensor
definition: The instructions and algorithms within an OT Controller defined by user programming to interpret inputs, process information, and determine outputs.

OT Control Program
type: Class
subclass of: Service Application
subclass of: Restriction
  on property: instructs
  some values from: OT Control Logic Process
type: NamedIndividual
instructs: OT Control Logic Process
synonym: OT Project File
definition: The file stored in controller memory that is used to operate the controller.

OT Control Variable
type: Class
subclass of: OT Logic Variable
definition: A control variable is the measurement of the physical condition of the device that influences the Process Variables.
example: If the Set Point of a temperature control system for a residential dwelling is 72 degrees, and the Process Variable is 82 degrees, the Control Variable for the air conditioner should be 'on.'

OT Controller
type: Class
subclass of: OT Embedded Computer
subclass of: Restriction
  on property: contains
  some values from: OT Control Program
subclass of: Restriction
  on property: manages
  some values from: OT Control Logic Process
subclass of: Restriction
  on property: powered-by
  some values from: OT Power Supply
type: NamedIndividual
contains: OT Control Program
manages: OT Control Logic Process
powered-by: OT Power Supply
definition: An OT Controller is an industrial control device that automatically regulates one or more controlled variables in response to command inputs and real-time feedback signals.

OT Create Data Command
type: Class
subclass of: OT Write Command
definition: OT command that creates data on a remote device.
comment: BACnet: addListElement BACnet: createObject
comment: CIP: Insert Member

OT Create Data Command Event
type: Class
subclass of: OT Write Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Create Data Command
definition: OT command that creates data on a remote device.

OT Create New Control Program Command
type: Class
subclass of: OT Modify Control Program Command
subclass of: Restriction
  on property: has-participant
  some values from: OT Control Program
type: NamedIndividual
has-participant: OT Control Program
comment: GE-SRTP: WRITE PROGRAM BLOCK MEMORY GE-SRTP: SET CONTROL ID(CPU ID) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC) GE-SRTP: TOGGLE FORCE SYSTEM MEMORY
definition: Commands a remote device to create an control program.

OT Create New Control Program Command Event
type: Class
subclass of: OT Modify Control Program Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Control Program
subclass of: Restriction
  on property: has-participant
  some values from: OT Create New Control Program Command
definition: Commands a remote device to create an control program.

OT Debug Command
type: Class
subclass of: OT Diagnostics Message
definition: Investigate or analyze the current state of the system.
comment: BACnet: getEnrollmentSummary BACnet: confirmed-audit-notification BACnet: audit-log-query BACnet: unconfirmed-audit-notification
comment: Modbus: Get Comm. Event Log Modbus: Return Query Data Modbus: Clear Counters Modbus: Get Comm. Event Counters

OT Debug Command Event
type: Class
subclass of: OT Diagnostics Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Debug Command
definition: Investigate or analyze the current state of the system.

OT Delete Control Program Command
type: Class
subclass of: OT Modify Control Program Command
subclass of: Restriction
  on property: modifies
  some values from: OT Control Program
type: NamedIndividual
modifies: OT Control Program
definition: Commands a remote device to remove an existing control program.

OT Delete Control Program Command Event
type: Class
subclass of: OT Modify Control Program Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Control Program
subclass of: Restriction
  on property: has-participant
  some values from: OT Delete Control Program Command
definition: Commands a remote device to remove an existing control program.

OT Delete Data Command
type: Class
subclass of: OT Write Command
definition: OT command that removes data on a remote device.
comment: BACnet: removeListElement BACnet: deleteObject

OT Delete Data Command Event
type: Class
subclass of: OT Write Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Delete Data Command
definition: OT command that removes data on a remote device.

OT Device Configuration Command
type: Class
subclass of: OT Device Management Message
definition: Configure or administer managed devices.
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: READ PROGRAM MEMORY GE-SRTP: WRITE PROGRAM BLOCK MEMORY GE-SRTP: CHANGE PLC CPU PRIVILEGE LEVEL GE-SRTP: SET CONTROL ID(CPU ID) GE-SRTP: SET PLC (RUN VS STOP) GE-SRTP: PROGRAM STORE (UPLOAD FROM PLC) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC) GE-SRTP: TOGGLE FORCE SYSTEM MEMORY

OT Device Configuration Command Event
type: Class
subclass of: OT Device Management Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Device Configuration Command
definition: Configure or administer managed devices.

OT Device Description Message
type: Class
subclass of: OT Device Management Message
definition: Describe features, abilities, or performance of system components.
comment: ENIP: List Services ENIP: List Interfaces
comment: GE-SRTP: RETURN CONTROL PROGRAM NAMES GE-SRTP: RETURN CONTROLLER TYPE AND ID INFORMATION

OT Device Description Message Event
type: Class
subclass of: OT Device Management Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Device Description Message
definition: Describe features, abilities, or performance of system components.

OT Exception Message
type: Class
subclass of: OT Diagnostics Message
definition: An unknown or anomalous condition occurred in the system.
comment: BACnet: Reject: 1 BACnet: Reject: 2 BACnet: Reject: 3 BACnet: Reject: 4 BACnet: Reject: 5 BACnet: Reject: 6 BACnet: Reject: 7 BACnet: Reject: 8 BACnet: Reject: 9 BACnet: Reject: 10
comment: Modbus: Read Exception Status Modbus: Exception: Illegal Function Modbus: Exception: Illegal Data Address Modbus: Exception: Illegal Data Value Modbus: Exception: Slave Device Failure Modbus: Exception: Acknowledge Modbus: Exception: Slave Device Busy Modbus: Exception: Memory Parity Error Modbus: Exception: Gateway Path Unavailable Modbus: Exception: Gateway Target Device Failed to Respond

OT Exception Message Event
type: Class
subclass of: OT Diagnostics Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Exception Message
definition: An unknown or anomalous condition occurred in the system.

OT Firmware Command
type: Class
subclass of: OT Device Management Message
definition: Interact with the software responsible for low-level control of the system.

OT Firmware Command Event
type: Class
subclass of: OT Device Management Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Firmware Command
definition: Interact with the software responsible for low-level control of the system.

OT Device Identification Message
type: Class
subclass of: OT Device Management Message
definition: Identify devices on the network.
comment: BACnet: i-Am BACnet: i-Have BACnet: who-Has BACnet: who-Is
comment: ENIP: List Identity
comment: Modbus: Read Device Identification Modbus: Report Slave ID

OT Device Identification Message Event
type: Class
subclass of: OT Device Management Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Device Identification Message
definition: Identify devices on the network.

OT Device Management Message
type: Class
subclass of: OT Protocol Message
definition: Manage devices and their configurations.

OT Device Management Message Event
type: Class
subclass of: OT Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Device Management Message
definition: Manage devices and their configurations.

OT Diagnostics Message
type: Class
subclass of: OT Protocol Message
definition: Relay error, exception, alarm, or log information.

OT Diagnostics Message Event
type: Class
subclass of: OT Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Diagnostics Message
definition: Relay error, exception, alarm, or log information.

OT Disconnect Remote Connection Command
type: Class
subclass of: OT Connection Command
definition: The Disconnect Request message is sent to the message receiver to indicate that the transmitter is terminating its TCP socket.

OT Disconnect Remote Connection Command Event
type: Class
subclass of: OT Connection Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Disconnect Remote Connection Command
subclass of: Restriction
  on property: preceded-by
  some values from: OT Establish Remote Connection Command Event
definition: The Disconnect Request message is sent to the message receiver to indicate that the transmitter is terminating its TCP socket.

OT Download Control Program Command
type: Class
subclass of: OT Modify Control Program Command
subclass of: Restriction
  on property: modifies
  some values from: OT Control Program
type: NamedIndividual
modifies: OT Control Program
definition: Commands a remote device to download a control program.
comment: GE-SRTP: PROGRAM STORE (UPLOAD FROM PLC) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC)
synonym: OT Program Download

OT Download Control Program Command Event
type: Class
subclass of: OT Modify Control Program Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Control Program
subclass of: Restriction
  on property: has-participant
  some values from: OT Download Control Program Command
definition: Commands a remote device to download a control program.

OT Embedded Computer
type: Class
subclass of: Embedded Computer
definition: A ruggedized computational device, embedded in industrial control systems, designed to handle real-time tasks and environmental stressors common in OT.

OT Engineering Software
type: Class
subclass of: Developer Application
subclass of: Restriction
  on property: produces
  some values from: OT Control Program
type: NamedIndividual
produces: OT Control Program
definition: Software used in an industrial process to help engineers design, test, and maintain OT. This software enables the programming of OT controllers.

OT Engineering Workstation
type: Class
subclass of: Client Computer
subclass of: Restriction
  on property: communicates-with
  some values from: OT Controller
subclass of: Restriction
  on property: runs
  some values from: OT Engineering Software
type: NamedIndividual
communicates-with: OT Controller
runs: OT Engineering Software
synonym: Workstation
synonym: Transient Cyber Asset
synonym: EWS
definition: An Engineering Workstation (EWS) is used to perform various maintenance, configuration, or diagnostics functions for a control system. The EWS will likely require dedicated application software to interface with various devices (e.g., RTUs, PLCs), and may be used to transfer data or files between the control system devices and other networks.

OT Error Message
type: Class
subclass of: OT Diagnostics Message
definition: An anticipated, reproducible defect occurred within the system.
comment: BACnet: Error: 1 BACnet: Error: 2 BACnet: Error: 3 BACnet: Error: 4 BACnet: Error: 5 BACnet: Error: 6 BACnet: Error: 7 BACnet: Error: 8

OT Error Message Event
type: Class
subclass of: OT Diagnostics Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Error Message
definition: An anticipated, reproducible defect occurred within the system.

OT Establish Remote Connection Command
type: Class
subclass of: OT Connection Command
definition: Used to establish an TCP/IP Connection to the target device.

OT Establish Remote Connection Command Event
type: Class
subclass of: OT Connection Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Establish Remote Connection Command
definition: Used to establish an TCP/IP Connection to the target device.

OT Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Protocol Message
definition: A discrete occurrence within an operational technology environment that denotes a significant change in state, execution of a command, or transmission of information.

OT I/O Module
type: Class
subclass of: I/O Module
subclass of: Restriction
  on property: communicates-with
  some values from: OT Actuator
subclass of: Restriction
  on property: communicates-with
  some values from: OT Sensor
type: NamedIndividual
communicates-with: OT Actuator
communicates-with: OT Sensor
comment: There are many types of I/O modules, including: analog input, analog output, HART input, HART output, digital input, digital output, mV input, pulse input, universal I/O, vibration input, and many other types of input or output modules. The functionality of the I/O Module can be embedded in the controller or as a separate module connected via chassis or I/O link.
example: Rockwell Compact 5000 IO Module
definition: An OT I/O Module is an industrial-grade interface designed for harsh Operational Technology (OT) environments. It reliably connects sensors and actuators to industrial control systems, ensuring precise, real-time data exchange in applications such as SCADA or ICS. Engineered for ruggedness and consistent performance, it can manage analog, digital, or other specialized signal types while enduring demanding conditions.

OT Logic Variable
type: Class
subclass of: Runtime Variable
type: NamedIndividual
definition: A variable which directly affects a program running on an OT controller, involving an OT Process.

OT Mode Switch
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: controls
  some values from: Operating Mode
type: NamedIndividual
controls: Operating Mode
definition: Keyswitch or mode switch is the mechanism for changing the operating mode of an OT controller or device.
synonym: Mode Switch
comment: An OT Mode Switch is a dedicated mechanism, implemented as either a physical keyswitch or a software control, that permits authorized users to transition an OT controller between its operating modes.
synonym: Programming Key Switch

OT Modify Control Program Command
type: Class
subclass of: OT Modify Device Configuration Command
subclass of: Restriction
  on property: modifies
  some values from: OT Control Program
type: NamedIndividual
modifies: OT Control Program
definition: OT command that adds, removes, or changes, process data on a remote device.
comment: GE-SRTP: WRITE PROGRAM BLOCK MEMORY GE-SRTP: CHANGE PLC CPU PRIVILEGE LEVEL GE-SRTP: SET CONTROL ID(CPU ID) GE-SRTP: PROGRAM STORE (UPLOAD FROM PLC) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC) GE-SRTP: TOGGLE FORCE SYSTEM MEMORY

OT Modify Control Program Command Event
type: Class
subclass of: OT Modify Device Configuration Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Control Program
subclass of: Restriction
  on property: has-participant
  some values from: OT Modify Control Program Command
definition: OT command that adds, removes, or changes, process data on a remote device.

OT Modify Device Configuration Command
type: Class
subclass of: OT Device Configuration Command
definition: Modify device configuration.
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: WRITE PROGRAM BLOCK MEMORY GE-SRTP: CHANGE PLC CPU PRIVILEGE LEVEL GE-SRTP: SET CONTROL ID(CPU ID) GE-SRTP: SET PLC (RUN VS STOP) GE-SRTP: PROGRAM STORE (UPLOAD FROM PLC) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC) GE-SRTP: TOGGLE FORCE SYSTEM MEMORY

OT Modify Device Configuration Command Event
type: Class
subclass of: OT Device Configuration Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Modify Device Configuration Command
definition: Modify device configuration.

OT Modify Device Operating Mode Command
type: Class
subclass of: OT Modify Device Configuration Command
subclass of: Restriction
  on property: modifies
  some values from: Operating Mode
type: NamedIndividual
modifies: Operating Mode
comment: GE-SRTP: SET PLC (RUN VS STOP)
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
definition: Modifies the running state of an application or program on a device.

OT Modify Device Operating Mode Command Event
type: Class
subclass of: OT Modify Device Configuration Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Modify Device Operating Mode Command
subclass of: Restriction
  on property: has-participant
  some values from: Operating Mode
definition: Modifies the running state of an application or program on a device.

OT Network Management Command
type: Class
subclass of: OT Protocol Message
definition: Manage message routing or network connection mechanisms.

OT Network Management Message Event
type: Class
subclass of: OT Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Network Management Command
definition: Manage message routing or network connection mechanisms.

OT Network Traffic
type: Class
subclass of: Network Traffic
subclass of: Restriction
  on property: may-contain
  some values from: OT Protocol Message
type: NamedIndividual
may-contain: OT Protocol Message
definition: Network traffic generated by operational technology devices, e.g. programmable logic controllers

OT Pause Command
type: Class
subclass of: OT Modify Device Operating Mode Command
subclass of: Restriction
  on property: modifies
  some values from: Operating Mode
type: NamedIndividual
modifies: Operating Mode
definition: Commands a device to pause a service/program.
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)

OT Pause Command Event
type: Class
subclass of: OT Modify Device Operating Mode Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Pause Command
subclass of: Restriction
  on property: has-participant
  some values from: Operating Mode
subclass of: Restriction
  on property: preceded-by
  some values from: OT Run Command Event
definition: Commands a device to pause a service/program.

OT Power Supply
type: Class
subclass of: Power Supply
type: NamedIndividual
example: Phoenix Contact QUINT, Eaton PSG, and many controller-branded power supplies.
definition: An OT power supply is a power supply whose control amplifier is optimized for signal-processing tasks rather than supplying mere steady-state power to a load. It is a self-contained combination of operational amplifiers, power amplifiers, and integral power circuits designed for higher-level operations in industrial or OT contexts.

OT Process Data Command
type: Class
subclass of: OT Protocol Message
definition: Manage data associated with a controlled process.

OT Process Data Command Event
type: Class
subclass of: OT Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Process Data Command
definition: Manage data associated with a controlled process.

OT Process Variable
type: Class
subclass of: OT Logic Variable
type: NamedIndividual
definition: Process variables are the current actual measurement of the physical characteristics of a system. Common process variables include but are not limited to Temperature, Pressure, Level, and Flow.
example: If the current temperature in a home is 82 degrees Fahrenheit, the process variable is 82 degrees.

OT Program Mode Command
type: Class
subclass of: OT Modify Device Operating Mode Command
subclass of: Restriction
  on property: modifies
  some values from: Operating Mode
type: NamedIndividual
modifies: Operating Mode
comment: GE-SRTP: SET PLC (RUN VS STOP)
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
definition: Command that places the controller in a mode capable of reprogramming logic. This may or may not stop the program.

OT Program Mode Command Event
type: Class
subclass of: OT Modify Device Operating Mode Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Program Mode Command
subclass of: Restriction
  on property: has-participant
  some values from: Operating Mode
definition: Command that places the controller in a mode capable of reprogramming logic. This may or may not stop the program.

OT Proprietary Message
type: Class
subclass of: OT Protocol Message
definition: Vendor specific and may not be publicly documented, or values left for device specific configuration.

OT Proprietary Message Event
type: Class
subclass of: OT Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Proprietary Message
definition: Vendor specific and may not be publicly documented, or values left for device specific configuration.

OT Protocol Message
type: Class
subclass of: Digital Message
type: NamedIndividual
definition: Packets generated by an operational technology protocol contain an OT protocol message.

OT Read Command
type: Class
subclass of: OT Process Data Command
definition: Read or retrieve data.
comment: BACnet: confirmedCOVNotification BACnet: subscribeCOV BACnet: atomicReadFile BACnet: readProperty BACnet: readPropertyConditional BACnet: readPropertyMultiple BACnet: unconfirmedCOVNotification BACnet: readRange BACnet: subscribeCOVProperty BACnet: getEventInformation BACnet: subscribe-cov-property-multiple BACnet: confirmed-cov-notification-multiple BACnet: unconfirmed-cov-notification-multiple
comment: CIP: Get Attributes All CIP: Get Attribute List CIP: Get Attribute Single CIP: Find Next Object Instance CIP: Get Member
comment: GE-SRTP: READ SYSTEM MEMORY GE-SRTP: READ TASK MEMORY
comment: Modbus: Read Coils Modbus: Read Discrete Inputs Modbus: Read Holding Registers Modbus: Read Input Registers Modbus: Read File Record Modbus: Read FIFO Queue

OT Read Command Event
type: Class
subclass of: OT Process Data Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Read Command
definition: Read or retrieve data.

OT Read Device Configuration Command
type: Class
subclass of: OT Device Configuration Command
definition: Read device configuration.
comment: BACnet: deviceCommunicationControl
comment: GE-SRTP: READ PROGRAM MEMORY

OT Read Device Configuration Command Event
type: Class
subclass of: OT Device Configuration Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Read Device Configuration Command
definition: Read device configuration.

OT Read File Command
type: Class
subclass of: OT Read Command
subclass of: Restriction
  on property: has-participant
  some values from: File
type: NamedIndividual
has-participant: File
comment: Modbus: Read File Record
definition: Reads data in specified chuncks or the contents of a specified file stored in the file device connected to the PC.
comment: BACnet: atomicReadFile

OT Read File Command Event
type: Class
subclass of: OT Read Command Event
subclass of: Restriction
  on property: has-participant
  some values from: File
subclass of: Restriction
  on property: has-participant
  some values from: OT Read File Command
definition: Reads data in specified chuncks or the contents of a specified file stored in the file device connected to the PC.

OT Read Value Command
type: Class
subclass of: OT Read Command
subclass of: Restriction
  on property: has-participant
  some values from: OT Logic Variable
type: NamedIndividual
has-participant: OT Logic Variable
comment: CIP: Get Attributes All CIP: Get Attribute List CIP: Get Attribute Single CIP: Find Next Object Instance CIP: Get Member
definition: Reads the contents of the specified number of consecutive parameter areawords starting from the specified word.
comment: GE-SRTP: READ SYSTEM MEMORY GE-SRTP: READ TASK MEMORY
comment: BACnet: confirmedCOVNotification BACnet: subscribeCOV BACnet: readProperty BACnet: readPropertyConditional BACnet: readPropertyMultiple BACnet: unconfirmedCOVNotification BACnet: readRange BACnet: subscribeCOVProperty BACnet: getEventInformation BACnet: subscribe-cov-property-multiple BACnet: confirmed-cov-notification-multiple BACnet: unconfirmed-cov-notification-multiple
comment: Modbus: Read Coils Modbus: Read Discrete Inputs Modbus: Read Holding Registers Modbus: Read Input Registers Modbus: Read FIFO Queue

OT Read Value Command Event
type: Class
subclass of: OT Read Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Logic Variable
subclass of: Restriction
  on property: has-participant
  some values from: OT Read Value Command
definition: Reads the contents of the specified number of consecutive parameter areawords starting from the specified word.

OT Read Time Command
type: Class
subclass of: OT Time Command
definition: Read timing mechanisms.
comment: example

OT Read Time Command Event
type: Class
subclass of: OT Time Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Read Time Command
definition: Read timing mechanisms.

OT Remote Mode Command
type: Class
subclass of: OT Modify Device Operating Mode Command
subclass of: Restriction
  on property: modifies
  some values from: Operating Mode
type: NamedIndividual
modifies: Operating Mode
definition: Command that places the controller in a mode capable of receiving read/write communication from a networked entity.
comment: GE-SRTP: SET PLC (RUN VS STOP)
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice

OT Remote Mode Command Event
type: Class
subclass of: OT Modify Device Operating Mode Command Event
subclass of: Restriction
  on property: has-participant
  some values from: Network Traffic
subclass of: Restriction
  on property: has-participant
  some values from: OT Remote Mode Command
subclass of: Restriction
  on property: has-participant
  some values from: Operating Mode
definition: Command that places the controller in a mode capable of receiving read/write communication from a networked entity.

OT Run Command
type: Class
subclass of: OT Modify Device Operating Mode Command
subclass of: Restriction
  on property: modifies
  some values from: Operating Mode
type: NamedIndividual
modifies: Operating Mode
comment: GE-SRTP: SET PLC (RUN VS STOP)
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
definition: Commands a device to start or resume a service/program.

OT Run Command Event
type: Class
subclass of: OT Modify Device Operating Mode Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Run Command
subclass of: Restriction
  on property: has-participant
  some values from: Operating Mode
definition: Commands a device to start or resume a service/program.

OT Security Command
type: Class
subclass of: OT Network Management Command
definition: Ensure confidentiality, integrity, or availability of system information.
comment: BACnet: authenticate BACnet: requestKey
comment: GE-SRTP: PROGRAMMER LOGON

OT Security Command Event
type: Class
subclass of: OT Network Management Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Security Command
definition: Ensure confidentiality, integrity, or availability of system information.

OT Sensor
type: Class
subclass of: Sensor
subclass of: Restriction
  on property: may-contain
  some values from: Client Computer
subclass of: Restriction
  on property: may-contain
  some values from: RF Transmitter
subclass of: Restriction
  on property: writes
  some values from: OT Process Variable
type: NamedIndividual
may-contain: Client Computer
may-contain: RF Transmitter
writes: OT Process Variable
definition: An OT Sensor is an industrial-grade sensing device engineered for operational technology (OT) environments (e.g. SCADA, ICS). It measures physical variables—such as pressure, temperature, or flow—under demanding conditions, converting them into reliable signals for real-time monitoring and process control loops.
comment: Components of the sensor include a sensing element and may include a power source, display, housing, communication interface or signal processor.

OT Set Time Command
type: Class
subclass of: OT Time Command
definition: Set timing mechanisms.

OT Set Time Command Event
type: Class
subclass of: OT Time Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Set Time Command
definition: Set timing mechanisms.

OT Stop Command
type: Class
subclass of: OT Modify Device Operating Mode Command
subclass of: Restriction
  on property: modifies
  some values from: Operating Mode
type: NamedIndividual
modifies: Operating Mode
comment: GE-SRTP: SET PLC (RUN VS STOP)
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
definition: Commands a device to stop a service/program.

OT Stop Command Event
type: Class
subclass of: OT Modify Device Operating Mode Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Stop Command
subclass of: Restriction
  on property: has-participant
  some values from: Operating Mode
subclass of: Restriction
  on property: preceded-by
  some values from: OT Run Command Event
definition: Commands a device to stop a service/program.

OT Synchronize Time Command
type: Class
subclass of: OT Time Command
definition: Used to align timing mechanisms.
comment: example

OT Synchronize Time Command Event
type: Class
subclass of: OT Time Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Synchronize Time Command
definition: Used to align timing mechanisms.

OT Test Command
type: Class
subclass of: OT Modify Device Operating Mode Command
subclass of: Restriction
  on property: modifies
  some values from: Operating Mode
type: NamedIndividual
modifies: Operating Mode
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
definition: Commands a device to run a program in Test mode.
comment: GE-SRTP: SET PLC (RUN VS STOP)

OT Test Command Event
type: Class
subclass of: OT Modify Device Operating Mode Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Test Command
subclass of: Restriction
  on property: has-participant
  some values from: Operating Mode
definition: Commands a device to run a program in Test mode.

OT Time Command
type: Class
subclass of: OT Device Management Message
definition: Read, set, or calculate timing mechanisms.
comment: BACnet: timeSynchronization BACnet: utcTimeSynchronization
comment: GE-SRTP: SET PLC TIME/DATE GE-SRTP: RETURN PLC TIME/DATE

OT Time Command Event
type: Class
subclass of: OT Device Management Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Time Command
definition: Read, set, or calculate timing mechanisms.

OT Transport Configuration Command
type: Class
subclass of: OT Network Management Command
definition: Configure transport settings for a communication channel.
comment: Modbus: Encapsulated Interface Transport

OT Transport Configuration Command Event
type: Class
subclass of: OT Network Management Message Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Transport Configuration Command
definition: Configure transport settings for a communication channel.

OT Write Command
type: Class
subclass of: OT Process Data Command
definition: Write or store data.
comment: BACnet: atomicWriteFile BACnet: addListElement BACnet: removeListElement BACnet: createObject BACnet: deleteObject BACnet: writeProperty BACnet: writePropertyMultiple BACnet: write-group
comment: CIP: Set Attributes All CIP: Set Attribute List CIP: Set Attribute Single CIP: Set Member CIP: Insert Member CIP: Remove Member
comment: GE-SRTP: WRITE SYSTEM MEMORY GE-SRTP: WRITE TASK MEMORY
comment: Modbus: Write Single Coil Modbus: Write Single Register Modbus: Write Multiple Coils Modbus: Write Multiple Registers Modbus: Write File Record Modbus: Mask Write Register Modbus: Read Write Register

OT Write Command Event
type: Class
subclass of: OT Process Data Command Event
subclass of: Restriction
  on property: has-participant
  some values from: OT Write Command
definition: Write or store data.

OWL
type: Class
subclass of: Description Logic
type: NamedIndividual
d3fend-id: D3A-OWL
definition: The Web Ontology Language (OWL) is a family of knowledge representation languages for authoring ontologies.
synonym: Web Ontology Language
kb-article: ## How it works Ontologies are a formal way to describe taxonomies and classification networks, essentially defining the structure of knowledge for various domains: the nouns representing classes of objects and the verbs representing relations between the objects. The OWL languages are characterized by formal semantics. They are built upon the World Wide Web Consortium's (W3C) standard for objects called the Resource Description Framework (RDF). OWL classes correspond to description logic (DL) _concepts_. OWL properties to DL _roles_, and individuals are named the same way in OWL and other DLs. ## References 1. Web Ontology Language. (2023, April 23). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Web_Ontology_Language)

Object Eviction
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Evict
type: NamedIndividual
enables: Evict
d3fend-id: D3-OE
definition: Terminate or remove an object from a host machine. This is the broadest class for object eviction.

Object File
type: Class
subclass of: File
type: NamedIndividual
definition: An object file is a file that contains relocatable machine code.

Offensive Action
type: Class
subclass of: Cyber Action

Offensive Tactic
type: Class
subclass of: Goal
subclass of: Restriction
  on property: enabled-by
  some values from: Offensive Technique
definition: Per ATT&CK, these are defined as Tactical Goals, not Tactics per se. Many children also fit definition of tactics. Some are neither tactics or tactical goals really (e.g., Execution, which is a useful grouping, but an action, not really a tactic or technique.
synonym: Tactical Objective

Offensive Technique
type: Class
subclass of: Cyber Technique
subclass of: Restriction
  on property: enables
  some values from: Offensive Tactic
subclass of: Restriction
  on property: initiates
  some values from: Access
display-baseurl: /offensive-technique/attack/

Office Application
type: Class
subclass of: UserApplication
type: NamedIndividual
definition: An office application is one that is part of an application suite (e.g., Microsoft Office, Open Office).

Office Application File
type: Class
subclass of: Document File
subclass of: Restriction
  on property: may-contain
  some values from: Image File
type: NamedIndividual
may-contain: Image File
definition: A document file in a format associated with an d3f:OfficeApplication.

One-time Password
type: Class
subclass of: Password Rotation
subclass of: Restriction
  on property: use-limits
  some values from: Password
type: NamedIndividual
kb-reference: Reference-DigitalIdentityGuidelines800-63-3
kb-reference: Reference-RFC2289-AOne-TimePasswordSystem
use-limits: Password
d3fend-id: D3-OTP
synonym: OTP
definition: A one-time password is valid for only one user authentication.
kb-article: ## How it works When a user initiates authentication, they are asked for a one-time password, often in addition to other credentials such as a traditional password or smart card. The one-time password may be from a list provided in advance, sent via a channel such as SMS or HTTPS to an app, or a generated token. In the case of a physical token which generates one-time passwords incrementally based on time elapsed, that token device need not be connected to the internet. In different implementations, an administrator of the system, or a user with additional verification, can adjust for clock skew between the token and the verification system as needed. ## Considerations ### Compromise of delivery channel - SIM Swapping - Secure token visual compromise - Insecure delivery channel ### Compromise of delivery device Physical loss of One-time Password device. ### Compromise of long-term backup codes These are often provided in the form of a downloadable document with a regular name, which can be searched for in the case that the user forgets where they put them. This digital file or printed document could be stolen. Additionally, after the code file is printed, it could be recovered from the system printer spool unless the spooler cache is cleared.

Open-source Developer
type: Class
subclass of: Product Developer
definition: An open-source developer contributes to the development, maintenance, or improvement of open-source projects.

Open File
type: Class
subclass of: System Call
subclass of: Restriction
  on property: accesses
  some values from: File
type: NamedIndividual
accesses: File
definition: For most file systems, a program initializes access to a file in a file system using the open system call. This allocates resources associated to the file (the file descriptor), and returns a handle that the process will use to refer to that file. In some cases the open is performed by the first access. During the open, the filesystem may allocate memory for buffers, or it may wait until the first operation. Various other errors which may occur during the open include directory update failures, un-permitted multiple connections, media failures, communication link failures and device failures.

Operating Mode
type: Class
subclass of: System Platform Variable
type: NamedIndividual
synonym: Keyswitch Position
definition: The Operating Mode designates the specific, selectable state of an OT controller that delineates its operational behavior and governs access to engineering functions, commonly including Program, Run, Remote, Test, or Stop.

Operating Mode Monitoring
type: Class
subclass of: Platform Monitoring
subclass of: Restriction
  on property: monitors
  some values from: Operating Mode
type: NamedIndividual
kb-reference: Reference-PLCKeySwitchMonitoring
kb-reference: Reference-TRITONMalwareRemainsThreattoGlobalCriticalInfrastructureICS
monitors: Operating Mode
d3fend-id: D3-OMM
definition: Detects operating modes such as Program, Run, Remote, or Stop.
kb-article: ## How it works Many OT Controllers have key switches to change the controller into various modes of operation. These modes of operation can include Program, Run, Remote, or Stop. The key switch position is often available as a system diagnostic function block of the programming logic. ## Considerations * It is advised to configure a key switch alarm such that an operator is alerted when the controller is put into a programming mode, as this could indicate unintentional or malicious changes to operational code.

Operating Mode Restriction
type: Class
subclass of: Access Mediation
subclass of: Restriction
  on property: restricts
  some values from: Operating Mode
type: NamedIndividual
kb-reference: Reference-MITREATTACKAuthorizationEnforcement
kb-reference: Reference-TRITONMalwareRemainsThreattoGlobalCriticalInfrastructureICS
restricts: Operating Mode
d3fend-id: D3-OPR
definition: Restricting unauthorized changes to the operating mode prevents devices from switching into inappropriate or vulnerable states during normal use.
kb-article: ## How it works Many OT Controllers use key switches to change the controller into different modes of operation. These modes of operation can include Program, Run, Remote, or Stop. The key switch should be left in the appropriate key switch position, e.g., run or remote during normal operations. Implement a key management procedure to include removing the physical key from the key switch when not in use.

Operating System
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Kernel
subclass of: Restriction
  on property: contains
  some values from: Local User Account
subclass of: Restriction
  on property: contains
  some values from: System Service Software
subclass of: Restriction
  on property: may-contain
  some values from: Operating System Configuration Component
type: NamedIndividual
contains: Kernel
contains: Local User Account
contains: System Service Software
may-contain: Operating System Configuration Component
definition: An operating system (OS) is system software that manages computer hardware and software resources and provides common services for computer programs. All computer programs, excluding firmware, require an operating system to function. Time-sharing operating systems schedule tasks for efficient use of the system and may also include accounting software for cost allocation of processor time, mass storage, printing, and other resources.

Operating System Configuration
type: Class
subclass of: Configuration Resource
type: NamedIndividual
definition: Information used to configure the services, parameters, and initial settings for an operating system.

Operating System Configuration Component
type: Class
subclass of: Operating System Configuration
type: NamedIndividual
definition: An component of the overall information necessary for the configuration of an operating system.
alternative label: System Configuration
alternative label: Operating System Configuration Information

Operating System Configuration File
type: Class
subclass of: Configuration File
subclass of: Operating System File
type: NamedIndividual
alternative label: System Configuration File
definition: An operating system configuration file is a file used to configure the operating system.

Operating System Configuration Modification Event
type: Class
subclass of: Configuration Modification Event
subclass of: Restriction
  on property: has-participant
  some values from: Operating System Configuration
definition: An event that alters persistent operating-system configuration resources such as kernel options, registry keys, service definitions, or security policies; affecting system startup, hardware interfaces, or global security enforcement.

Operating System Executable File
type: Class
subclass of: Operating System File
type: NamedIndividual
definition: An operating system executable is a critical executable that is part of the operating system, and without which, the operating system may not operate correctly.

Operating System File
type: Class
subclass of: File
type: NamedIndividual
definition: An operating system file is a file that is part of, or used to store information about, the operating system itself.

Operating System Log File
type: Class
subclass of: Log File
subclass of: Operating System File
type: NamedIndividual
definition: An operating system log file records events that occur in an operating system.

Operating System Monitoring
type: Class
subclass of: Platform Monitoring
type: NamedIndividual
enables: Detect
kb-reference: Reference-HostIntrusionPreventionSystemUsingSoftwareAndUserBehaviorAnalysis SophosLtd
kb-reference: Reference-UserActivityFromClearingEventLogs MITRE
d3fend-id: D3-OSM
kb-article: ## Technique Overview "An operating system (OS) is system software that manages computer hardware and software resources and provides common services for computer programs." [1] Operating System Monitoring Techniques have varied implementations including built-in kernel modules, third-party privileged system daemons, or even standard systems administration tools included with an operating system. 1. http://dbpedia.org/resource/Operating_system
definition: The operating system software, for D3FEND's purposes, includes the kernel and its process management functions, hardware drivers, initialization or boot logic. It also includes and other key system daemons and their configuration. The monitoring or analysis of these components for unauthorized activity constitute **Operating System Monitoring**.

Operating System Packaging Tool
type: Class
subclass of: Software Packaging Tool
definition: A software packaging tool oriented on building a software package for a particular operating system (e.g. rpmbuild.)

Operating System Process
type: Class
subclass of: Process
type: NamedIndividual
alternative label: System Process
definition: An operating system process, or system process, is a process running to perform operating system functions.

Operating System Shared Library File
type: Class
subclass of: Operating System File
subclass of: Shared Library File
type: NamedIndividual
definition: An operating system shared library file is a shared library file that is part of the operating system and that incorporates common operating system code for use by any application or to provide operating system services.

Operational Activity Mapping
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Model
type: NamedIndividual
enables: Model
kb-reference: Reference-CatiaUAFPlugin
d3fend-id: D3-OAM
definition: Operational activity mapping identifies activities of the organization and the organization's suborganizations, groups, roles, and individuals that carry out the activities and then establishes the dependencies of the activities on the systems and people that perform those activities.
synonym: Mission Mapping

Operational Dependency Mapping
type: Class
subclass of: Operational Activity Mapping
subclass of: Restriction
  on property: maps
  some values from: Dependency
subclass of: Restriction
  on property: maps
  some values from: Organizational Activity
type: NamedIndividual
kb-reference: Reference-CatiaUAFPlugin
kb-reference: Reference-CyberCommandSystemCYCS
kb-reference: Reference-DaggerFactSheet
kb-reference: Reference-DaggerModelingAndVisualizationForMissionImpactSituationalAwareness
kb-reference: Reference-MissionDependencyModelingForCyberSituationalAwareness
kb-reference: Reference-UnifiedArchitectureFrameworkUAF
maps: Dependency
maps: Organizational Activity
d3fend-id: D3-ODM
definition: Operational dependency mapping identifies and models the dependencies of the organization's activities on each other and on the organization's performers (people, systems, and services.) This may include modeling the higher- and lower-level activities of an organization forming a hierarchy, or layering, of the dependencies in an organization's activities.

Operational Risk Assessment
type: Class
subclass of: Operational Activity Mapping
subclass of: Restriction
  on property: evaluates
  some values from: Organization
subclass of: Restriction
  on property: identifies
  some values from: Vulnerability
type: NamedIndividual
evaluates: Organization
identifies: Vulnerability
kb-reference: Reference-NIST-RMF-Quick-Start-Guide-Assess-Step-FAQ
kb-reference: Reference-NIST-Special-Publication-800-160-Volume-1
kb-reference: Reference-NIST-Special-Publication-800-37-Revision-2
kb-reference: Reference-NIST-Special-Publication-800-53A-Revision-5
kb-reference: Reference-NISTIR-8011-Volume-1
d3fend-id: D3-ORA
definition: Operational risk assessment identifies and models the vulnerabilities of, and risks to, an organization's activities individually and as a whole.
synonym: Mission Risk Assessment

Operations Center Computer
type: Class
subclass of: Shared Computer
definition: Mainframe computers or mainframes (colloquially referred to as "big iron") are computers used primarily by large organizations for critical applications; bulk data processing, such as census, industry and consumer statistics, and enterprise resource planning; and transaction processing. They are larger and have more processing power than some other classes of computers: minicomputers, servers, workstations, and personal computers.
alternative label: Mainframe

Optical Disc Image
type: Class
subclass of: Disk Image
definition: An optical disc image (or ISO image, from the ISO 9660 file system used with CD-ROM media) is a disk image that contains everything that would be written to an optical disc, disk sector by disc sector, including the optical disc file system.

Optical Modem
type: Class
subclass of: Modem
definition: A modem that connects to a fiber optic network is known as an optical network terminal (ONT) or optical network unit (ONU). These are commonly used in fiber to the home installations, installed inside or outside a house to convert the optical medium to a copper Ethernet interface, after which a router or gateway is often installed to perform authentication, routing, NAT, and other typical consumer internet functions, in addition to "triple play" features such as telephony and television service.

Orchestration Controller
type: Class
subclass of: Orchestration Server
subclass of: Restriction
  on property: contains
  some values from: Container Orchestration Software
type: NamedIndividual
contains: Container Orchestration Software
definition: An orchestration server provides orchestration services that automate the configuration, coordination, and management of computer systems and software.

Orchestration Server
type: Class
subclass of: Server
definition: A d3f:Server which is involved with the orchestration of workloads or the execution of orchestrated workloads.

Orchestration Worker
type: Class
subclass of: Orchestration Server
definition: A d3f:Server which receives commands from a d3f:OrchestrationController to execute workloads.

Organization
type: Class
subclass of: Agent Group
subclass of: Non-Person Entity
subclass of: Restriction
  on property: has-member
  some values from: Person
type: NamedIndividual
definition: An organization with a defined mission/goal and a defined boundary, using systems to execute that mission, and with responsibility for managing its own risks and performance. An enterprise may consist of all or some of the following business aspects: acquisition, program management, human resources, financial management, security, and systems, information and mission management

Organization Mapping
type: Class
subclass of: Operational Activity Mapping
subclass of: Restriction
  on property: maps
  some values from: Dependency
subclass of: Restriction
  on property: maps
  some values from: Organization
subclass of: Restriction
  on property: maps
  some values from: Person
subclass of: Restriction
  on property: may-map
  some values from: Organizational Activity
type: NamedIndividual
kb-reference: Reference-CatiaUAFPlugin
kb-reference: Reference-OrganizationalManagementInSAPERPHCM
kb-reference: Reference-UnifiedArchitectureFrameworkUAF
maps: Dependency
maps: Organization
maps: Person
may-map: Organizational Activity
d3fend-id: D3-OM
definition: Organization mapping identifies and models the people, roles, and groups with an organization and the relations between them.
display-order: 4

Organizational Activity
type: Class
subclass of: Plan
type: NamedIndividual
synonym: Mission Function
synonym: Business Process
see also: Mission Critical Function
definition: An activity is a specific behavior representing a set of actions that may be accomplished by an agent.

Outbound Internet DNS Lookup Traffic
type: Class
subclass of: DNS Network Traffic
subclass of: Outbound Internet Network Traffic
subclass of: Outbound Network Traffic
subclass of: Restriction
  on property: may-contain
  some values from: DNS Lookup
type: NamedIndividual
may-contain: DNS Lookup
definition: Outbound internet DNS lookup traffic is network traffic using the DNS protocol on an outgoing connection initiated from a host within a network to a host outside the network.

Outbound Internet Encrypted Remote Terminal Traffic
type: Class
subclass of: Outbound Internet Encrypted Traffic
type: NamedIndividual
alternative label: Outbound Internet Encrypted RDP Traffic
alternative label: Outbound Internet Encrypted SSH Traffic
definition: Outbound internet encrypted remote terminal traffic is encrypted network traffic for a standard remote terminal protocol on an outgoing connection initiated from a host within a network to a host outside the network.

Outbound Internet Encrypted Traffic
type: Class
subclass of: Outbound Internet Network Traffic
type: NamedIndividual
definition: Outbound internet encrypted traffic is encrypted network traffic on an outgoing connection initiated from a host within a network to a host outside the network.

Outbound Internet Encrypted Web Traffic
type: Class
subclass of: Outbound Internet Encrypted Traffic
subclass of: Outbound Internet Web Traffic
type: NamedIndividual
definition: Outbound internet encrypted web traffic is network traffic using a standard web protocol on an outgoing connection initiated from a host within a network to a host outside the network.

Outbound Internet File Transfer Traffic
type: Class
subclass of: File Transfer Network Traffic
subclass of: Outbound Internet Network Traffic
subclass of: Outbound Network Traffic
subclass of: Restriction
  on property: contains
  some values from: File
type: NamedIndividual
contains: File
definition: Outbound internet file transfer traffic is file transfer traffic that is: (a) on an outgoing connection initiated from a host within a network to a host outside the network, and (b) using a standard file transfer protocol.

Outbound Internet Mail Traffic
type: Class
subclass of: Outbound Internet Network Traffic
type: NamedIndividual
alternative label: Outbound Internet Email Traffic
definition: Outbound internet DNS lookup traffic is network traffic using a standard email protocol on an outgoing connection initiated from a host within a network to a host outside the network.

Outbound Internet Network Traffic
type: Class
subclass of: Internet Network Traffic
subclass of: Outbound Network Traffic
type: NamedIndividual
definition: Outbound internet network traffic is network traffic on an outgoing connection initiated from a host within a network to a host outside the network.

Outbound Internet RPC Traffic
type: Class
subclass of: Outbound Internet Network Traffic
subclass of: Outbound Network Traffic
subclass of: RPC Network Traffic
definition: Outbound internet RPC traffic is RPC traffic that is: (a) on an outgoing connection initiated from a host within a network to a host outside the network, and (b) using a standard RPC protocol.

Outbound Internet Web Traffic
type: Class
subclass of: Outbound Internet Network Traffic
subclass of: WebNetworkTraffic
subclass of: Restriction
  on property: may-contain
  some values from: URL
type: NamedIndividual
may-contain: URL
definition: Outbound internet web traffic is network traffic that is: (a) on an outgoing connection initiated from a host within a network to a host outside the network, and (b) using a standard web protocol.

Outbound Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: Outbound traffic is network traffic originating from a host of interest (client), to another host (server).

Outbound Traffic Filtering
type: Class
subclass of: Network Traffic Filtering
subclass of: Restriction
  on property: filters
  some values from: Outbound Network Traffic
type: NamedIndividual
filters: Outbound Network Traffic
kb-reference: Reference-AutomaticallyGeneratingRulesForConnectionSecurity Microsoft
d3fend-id: D3-OTF
definition: Restricting network traffic originating from a private host or enclave destined towards untrusted networks.
kb-article: ## How it works Outbound traffic, in this context, is network traffic originating from a private host or enclave destined towards untrusted networks. For example: * An enterprise desktop intranet user connecting to www.example.com * An internal mail server connecting to an external mail server, mail.example.com Filtering is commonly implemented as firewall rulesets to limit outbound traffic permitted to egress a host or network. Firewalls are deployed either directly on hosts through kernel level software implementations or installed in-line directly on network links. There are benefits and disadvantages to each approach. There are various strategies for developing filtering rulesets: * Block everything by default * Limit destination hosts * Limit destination transport or application protocols * Restrict content outbound (Ex. strings formatted as social security numbers, or proprietary data) ## Considerations * Dynamic IP assignment creates challenges for Outbound Traffic Filtering because users are not necessarily associated with the same IP address. This can be addressed by linking IP address management information with the filtering logic. * Connections using non-standard transport layer ports may circumvent outbound traffic filtering technology which does not detect application protocol based on traffic content. * Business requirements typically drive the development of filtering rule sets. ## Implementations - iptables (Linux) - Windows Firewall - pf (BSD)

Output Device
type: Class
subclass of: Hardware Device
definition: An output device is any piece of computer hardware equipment which converts information into human-readable form. It can be text, graphics, tactile, audio, and video. Some of the output devices are Visual Display Units (VDU) i.e. a Monitor, Printer, Graphic Output devices, Plotters, Speakers etc. A new type of Output device is been developed these days, known as Speech synthesizer, a mechanism attached to the computer which produces verbal output sounding almost like human speeches.

Output Device Event
type: Class
subclass of: Hardware Device Event
subclass of: Restriction
  on property: has-participant
  some values from: Output Device
definition: An event describing the activity or state of output devices, including sound cards, display adapters, or media controllers. These events relate to audio, video, or graphics functionality.

POSIX Symbolic Link
type: Class
subclass of: Symbolic Link
subclass of: UnixLink
definition: A POSIX-compliant symbolic link. These are often fast symbolic links, but need not be.

Package URL
type: Class
subclass of: URL
subclass of: Restriction
  on property: identifies
  some values from: Software Package
type: NamedIndividual
identifies: Software Package
alternative label: purl
definition: A package URL, or purl, is a URL used to identify a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases.

Packet Capture File
type: Class
subclass of: File
subclass of: Restriction
  on property: contains
  some values from: Network Packet
type: NamedIndividual
contains: Network Packet
definition: A file which contains raw representations of collected packets.

Packet Log
type: Class
subclass of: Log
subclass of: Restriction
  on property: records
  some values from: Network Session
subclass of: Restriction
  on property: summarizes
  some values from: Packet Capture File
type: NamedIndividual
records: Network Session
summarizes: Packet Capture File
definition: A log of all the network packet data captured from a network by a network sensor (i.e., packet analyzer),

Page
type: Class
subclass of: Memory Block
definition: A page, memory page, logical page, or virtual page is a fixed-length contiguous block of virtual memory, described by a single entry in the page table. It is the smallest unit of data for memory management in a virtual memory operating system.

Page Frame
type: Class
subclass of: Memory Block
subclass of: Restriction
  on property: contained-by
  some values from: Primary Storage
type: NamedIndividual
contained-by: Primary Storage
definition: A page frame is the smallest fixed-length contiguous block of physical memory into which memory pages are mapped by the operating system.

Page Table
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Physical Address
subclass of: Restriction
  on property: contains
  some values from: VirtualAddress
type: NamedIndividual
contains: Physical Address
contains: VirtualAddress
definition: A page table is the data structure used by the MMU in a virtual memory computer system to store the mapping between virtual addresses (virtual pages) and physical addresses (page frames).

Parameter-based Transfer Learning
type: Class
subclass of: Homogenous Transfer Learning
type: NamedIndividual
d3fend-id: D3A-PBTL
definition: The idea behind parameter-based methods is that a well-trained model on the source domain has learned a well-defined structure, and if two tasks are related, this structure can be transferred to the target model.
kb-article: ## References Georgian Impact Blog. (n.d.). Transfer Learning Part 1. [Link](https://medium.com/georgian-impact-blog/transfer-learning-part-1-ed0c174ad6e7#:~:text=Homogeneous%20Transfer%20Learning-,1.,the%20target%20domain%20for%20training).

Parametric Tests
type: Class
subclass of: Hypothesis Testing
type: NamedIndividual
d3fend-id: D3A-PT
definition: A parametric test relies upon the assumption that the data you want to test is (or approximately is) normally distributed.
kb-article: ## References Newcastle University. (n.d.). Parametric Hypothesis Tests. [Link](https://www.ncl.ac.uk/webtemplate/ask-assets/external/maths-resources/psychology/parametric-hypothesis-tests.html)

Parent Process
type: Class
subclass of: Process
definition: In computing, a parent process is a process that has created one or more child processes.

Partial Matching
type: Class
subclass of: String Pattern Matching
type: NamedIndividual
d3fend-id: D3A-PM
kb-article: Numeric pattern matching is a method of matching some defined pattern specification against a numeric value.
kb-article: ## References 1. String-searching algorithm. (2023, April 8). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/String-searching_algorithm)
definition: Partial string pattern matching is a special case of string pattern matching where one seeks to find a pattern within a larger string (text). It allows for the detection of patterns that occur as substrings or partial segments within the full string, rather than requiring an exact match across the entire string.

Partition
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
alternative label: Disk Slice
definition: A partition is a region on secondary storage device created so that the region can be managed by itself; separate from any other regions (partitions) on that secondary storage device. Creating partitions is typically the first step of preparing a newly installed storage device, before any file system is created. The device stores the information about the partitions' locations and sizes in an area known as the partition table that the operating system reads before any other part of the disk. Each partition then appears to the operating system as a distinct "logical" storage device that uses part of the actual device. System administrators use a program called a partition editor to create, resize, delete, and manipulate the partitions. Partitioning allows the use of different filesystems to be installed for different kinds of files. Separating user data from system data can prevent the system partition from becoming full and rendering the system unusable. Partitioning can also make backing up easier. [Definition adapted as generalization from definition of disk partitioning and distinct from in-memory partitions.]
alternative label: Disk Partition

Partition Table
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: addresses
  some values from: Partition
subclass of: Restriction
  on property: may-contain
  some values from: Boot Record
type: NamedIndividual
addresses: Partition
may-contain: Boot Record
definition: A partition is a fixed-size subset of a storage device which is treated as a unit by the operating system. A partition table is a table maintained on the storage device by the operating system describing the partitions on that device. The terms partition table and partition map are most commonly associated with the MBR partition table of a Master Boot Record (MBR) in IBM PC compatibles, but it may be used generically to refer to other "formats" that divide a disk drive into partitions, such as: GUID Partition Table (GPT), Apple partition map (APM), or BSD disklabel.

Passive Certificate Analysis
type: Class
subclass of: Certificate Analysis
type: NamedIndividual
kb-reference: Reference-CertificateTransparency
kb-reference: Reference-StreamingPhish
d3fend-id: D3-PCA
definition: Collecting host certificates from network traffic or other passive sources like a certificate transparency log and analyzing them for unauthorized activity.
kb-article: ## How it works Certificates are analyzed outside of a TLS server connection using third-party secure update logs, domain name analysis and analytics. ### Secure update certificate logs * Certificate Logs The key enabling feature is a secure service that maintains record logs of certificate activities. The logs allow users to only append certificates and never to delete or modify the log entries. The logs use Merkle Tree Hashes to ensure they have not been tampered with. The logging service also allows for public auditing by any user. The logging service, upon receipt of a certificate to log, will respond with a signed certificate timestamp (SCT). The SCT guarantees the certificate will be added to the log within the time specified. The SCT must be present with the certificate during a TLS handshake. * Certificate Monitoring Certificate monitoring, of the logs, is typically done by the CA and they watch for suspicious certificate logging and unusual certificates or extensions or permissions. Monitors are also responsible for verifying the logs are accurate and public. * Certificate Auditors Log integrity is verified by log auditors. Auditors make use of log proofs are used to validate the cryptographic hashes (Merkle Trees) that the log employs are consistent. In order to ensure consistency throughout multiple monitors and auditors, sharing a common logging service, gossip protocol is employed. ### Phishing domain name analysis * A curated corpus of known benign domains and phishing domain names is used as training text for machine learning. Through the use of feature set extraction, vectors labels are created with scoring to indicated if they are considered benign or phishing domains. * A stream of new or updated SSL certificates with fully qualified domain names (FQDN) is analyzed against the feature vectors and a predictive model determines a score for the domains. The scoring considers distance measures such as Levenshtein distance to help in determining the fin…

Passive Logical Link Mapping
type: Class
subclass of: Logical Link Mapping
type: NamedIndividual
kb-reference: Reference-TenablePassiveNetworkMonitoring
d3fend-id: D3-PLLM
definition: Passive logical link mapping only listens to network traffic as a means to map the the whole data link layer, where the links represent logical data flows rather than physical connections.
synonym: Passive Logical Layer Mapping

Password
type: Class
subclass of: Credential
type: NamedIndividual
definition: A password, sometimes called a passcode, is a memorized secret, typically a string of characters, usually used to confirm the identity of a user. Using the terminology of the NIST Digital Identity Guidelines, the secret is memorized by a party called the claimant while the party verifying the identity of the claimant is called the verifier. When the claimant successfully demonstrates knowledge of the password to the verifier through an established authentication protocol, the verifier is able to infer the claimant's identity.
alternative label: Passcode

Password Authentication
type: Class
subclass of: Agent Authentication
subclass of: Restriction
  on property: uses
  some values from: Password
type: NamedIndividual
kb-reference: Reference-NIST-Special-Publication-800-53-Revision-5
uses: Password
d3fend-id: D3-PWA
definition: Password authentication is a security mechanism used to verify the identity of a user or entity attempting to access a system or resource by requiring the input of a secret string of characters, known as a password, that is associated with the user or entity.

Password Database
type: Class
subclass of: Database
definition: A password database is a database that holds passwords for user accounts and is usually encrypted (i.e.., the passwords are hashed). Password databases are found supporting system services (such as SAM) or part of user applications such as password managers.

Password File
type: Class
subclass of: File
subclass of: Password Database
type: NamedIndividual
definition: Simple form of password database held in a single file (e.g., /etc/password)

Password Manager
type: Class
subclass of: Application
definition: A password manager is a software application or hardware that helps a user store and organize passwords. Password managers usually store passwords encrypted, requiring the user to create a master password: a single, ideally very strong password which grants the user access to their entire password database. Some password managers store passwords on the user's computer (called offline password managers), whereas others store data in the provider's cloud (often called online password managers). However offline password managers also offer data storage in the user's own cloud accounts rather than the provider's cloud. While the core functionality of a password manager is to securely store large collections of passwords, many provide additional features such as form filling and password generation.

Password Rotation
type: Class
subclass of: Credential Rotation
subclass of: Restriction
  on property: regenerates
  some values from: Password
type: NamedIndividual
kb-reference: Reference-PasswordandKeyRotation-SSH
regenerates: Password
d3fend-id: D3-PR
definition: Password rotation is a security policy that mandates the periodic change of user account passwords to mitigate the risk of unauthorized access due to compromised credentials.
kb-article: ## How it works Users may be requested to change their passwords on a regular schedule. Management servers with enterprise policies for account management provide the ability to change or reset passwords for accounts. ## Considerations Requiring users to change their passwords frequently can result in insecure password practices by the user. The latest update of NIST SP 800-63B, Digital Identity Guidelines, recommends requiring password reset only when a known compromise has occurred, or every 365 days, rather than every 60 or 90 days.

Password Store
type: Class
subclass of: Password Database
type: NamedIndividual
definition: A user repository of account passwords, often accessed via a password manager.

Patent Reference
type: Class
subclass of: Technique Reference
pref-label: Patent

Pattern Matching
type: Class
subclass of: Logical Rules
type: NamedIndividual
d3fend-id: D3A-PM
definition: Pattern matching is the act of checking a given sequence of tokens for the presence of the constituents of some pattern.
kb-article: ## References 1. Pattern matching. (2023, May 20). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Pattern_matching)

Pearson's Correlation Coefficient
type: Class
subclass of: Correlation
type: NamedIndividual
d3fend-id: D3A-PCC
kb-article: ## References Wolfram MathWorld. (n.d.). Correlation Coefficient. [Link](https://mathworld.wolfram.com/CorrelationCoefficient.html)

Per Host Download-Upload Ratio Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
type: NamedIndividual
analyzes: Network Traffic
kb-reference: Reference-SystemForDetectingThreatsUsingScenario-basedTrackingOfInternalAndExternalNetworkTraffic VECTRANETWORKSInc
d3fend-id: D3-PHDURA
definition: Detecting anomalies that indicate malicious activity by comparing the amount of data downloaded versus data uploaded by a host.
kb-article: ## How it works Aggregate pull vs. push ratios from metadata are used to develop a baseline for a given host over a specific time period, e.g., over a three-hour period, one day, one week, etc. Anomalies identified over a threshold produce an alert. ## Considerations Collection and analysis of large network packet captures requires large storage and intensive computing power. The time windows used to calculate the ratio may vary in implementations, this consideration should take into account a threat model and likely effects (impacts) delivered by an adversary.

Peripheral Device Event
type: Class
subclass of: Hardware Device Event
subclass of: Restriction
  on property: has-participant
  some values from: Removable Media Device
definition: An event involving external or auxiliary devices, such as USB drives, Thunderbolt peripherals, or Bluetooth devices. Peripheral events provide visibility into resource availability and potential unauthorized access.

Peripheral Firmware
type: Class
subclass of: Firmware
type: NamedIndividual
definition: Firmware that is installed on computer peripheral devices.

Peripheral Firmware Verification
type: Class
subclass of: Firmware Verification
subclass of: Restriction
  on property: verifies
  some values from: Peripheral Firmware
type: NamedIndividual
kb-reference: Reference-FirmwareVerificationEclypsium
kb-reference: Reference-FirmwareVerificationTrapezoid
verifies: Peripheral Firmware
d3fend-id: D3-PFV
kb-article: # How it works Peripherial firmware is collected and analyzed on a host either periodically or on demand. This information may be collected for future comparisons. Changes in firmware hash values may indicate that the firmware has been tampered with or that firmware images are not maintained to current baselined versions, or even known vulnerable versions are deployed. ## Considerations * Trust baselines will need to be generated for specific devices * Changes to trusted configurations will need to be managed across the enterprise
definition: Cryptographically verifying peripheral firmware integrity.

Peripheral Hub Firmware
type: Class
subclass of: Peripheral Firmware
definition: Firmware that is installed on peripheral hub device such as a USB or Firewire hub.
alternative label: USB Hub Firmware

Permission Granting Event
type: Class
subclass of: Access Control Administration Event
definition: An administrative event where authorization is given, allowing a subject to perform specific operations on a protected resource, effectuating a policy decision to allow access rights.

Permission Revoking Event
type: Class
subclass of: Access Control Administration Event
definition: An administrative event entailing the withdrawal of previously granted access rights, reconfiguring permissions to prevent a subject from performing specific actions on a resource, in accordance with updated access policies.

Persistence Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Persistence
type: NamedIndividual
enables: Persistence

Person
type: Class
subclass of: Agent
subclass of: Restriction
  on property: name
  some values from: string
type: NamedIndividual
definition: A person is a human being.

Personal Computer
type: Class
subclass of: Client Computer
definition: A personal computer (PC) is a multi-purpose computer whose size, capabilities, and price make it feasible for individual use. Personal computers are intended to be operated directly by an end user, rather than by a computer expert or technician. Unlike large, costly minicomputers and mainframes, time-sharing by many people at the same time is not used with personal computers. PCs have in practice become powerful enough that they may be shared by multiple users at any given time, though this is not common practice nor the primary purpose of a PC.

Perturbation-based Learning
type: Class
subclass of: Intrinsically Semi-supervised Learning
type: NamedIndividual
d3fend-id: D3A-PBL
definition: Perturbation based methods are proposed under the smoothness assumption, which indicates that two data points close to each other in feature space are likely to have the same label.
kb-article: ## References Zheng, Y., & Song, Y. (2021). An Effective Perturbation-Based Semi-Supervised Learning Method for Acoustic Event Classification. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 29, 3580-3591. [Link](https://www.semanticscholar.org/paper/An-Effective-Perturbation-Based-Semi-Supervised-for-Zheng-Song/b75ae37d137ac354eb2ed42917e461b4dccdc977). Engelen, S., & Hoos, H. (2020). A survey on semi-supervised learning. Machine Learning, 109(2), 299-337. [Link](https://link.springer.com/article/10.1007/s10994-019-05855-6).

Phi Coefficient
type: Class
subclass of: Correlation
type: NamedIndividual
d3fend-id: D3A-PC
definition: The phi coefficient (or mean square contingency coefficient is a measure of association for two binary variables.
kb-article: ## References \Wikipedia. (n.d.). Phi coefficient. [Link](https://en.wikipedia.org/wiki/Phi_coefficient)
synonym: MCC
synonym: Matthews Correlation Coefficient (in machine learning)

Physical Access Mediation
type: Class
subclass of: Access Mediation
subclass of: Restriction
  on property: isolates
  some values from: Physical Artifact
type: NamedIndividual
isolates: Physical Artifact
kb-reference: Reference-CNNSI-4009
d3fend-id: D3-PAM
definition: Physical access mediation is the process of granting or denying specific requests to enter specific physical facilities (e.g., Federal buildings, military establishments, border crossing entrances.)
synonym: Physical Access Control

Physical Address
type: Class
subclass of: Memory Address
type: NamedIndividual
definition: In a computer supporting virtual memory, the term physical address is used mostly to differentiate from a virtual address. In particular, in computers utilizing a memory management unit(MMU) to translate memory addresses, the virtual and physical addresses refer to an address before and after translation performed by the MMU, respectively.

Physical Artifact
type: Class
subclass of: Artifact
subclass of: Restriction
  on property: has-location
  some values from: Physical Location
type: NamedIndividual
alternative label: Physical Object

Physical Attacker
type: Class
subclass of: Local Attacker
subclass of: Restriction
  on property: accesses
  some values from: Computer Platform
subclass of: Restriction
  on property: accesses
  some values from: Hardware Device
definition: An attacker who is physically close enough to interact with the system directly, such as through physical access to devices.

Physical Link
type: Class
subclass of: Link
type: NamedIndividual
definition: A physical link is a dedicated connection for communication that uses some physical media (electrical, electromagnetic, optical, to include clear spaces or vacuums.) A physical link represents only a single hop (link) in any larger communcations path, circuit, or network. NOTE: not synonymous with data link as a data link can be over a telecommunications circuit, which may be a virtual circuit composed of multiple phyical links.
synonym: Layer-1 Link

Physical Link Connect Event
type: Class
subclass of: Physical Link Event
subclass of: Restriction
  on property: precedes
  some values from: Physical Link Up Event
definition: The medium is attached or the port is enabled, establishing electrical or optical continuity so that link negotiation can begin.

Physical Link Disable Event
type: Class
subclass of: Physical Link Event
subclass of: Restriction
  on property: preceded-by
  some values from: Physical Link Up Event
definition: An administrator issues a shutdown or disable command, forcing the link out of service regardless of signal status.

Physical Link Disconnect Event
type: Class
subclass of: Physical Link Event
subclass of: Restriction
  on property: preceded-by
  some values from: Physical Link Down Event
definition: The transmission medium is removed or power is cut, physically breaking the path between the two interfaces.

Physical Link Down Event
type: Class
subclass of: Physical Link Event
subclass of: Restriction
  on property: preceded-by
  some values from: Physical Link Up Event
subclass of: Restriction
  on property: precedes
  some values from: Physical Link Disconnect Event
definition: Carrier or negotiation is lost, or the port is shut, rendering the link non-operational while the medium remains connected.

Physical Link Error Disable Event
type: Class
subclass of: Physical Link Event
subclass of: Restriction
  on property: preceded-by
  some values from: Physical Link Down Event
definition: The device automatically disables the link in response to fault conditions such as excessive faults or signal degradation.

Physical Link Event
type: Class
subclass of: Network Device Event
subclass of: Restriction
  on property: has-participant
  some values from: Physical Link
definition: A discrete event that changes either the presence of the transmission medium or the operational state of a single-hop layer-1 link between two network nodes.

Physical Link Mapping
type: Class
subclass of: Network Mapping
subclass of: Restriction
  on property: maps
  some values from: Network Node
subclass of: Restriction
  on property: maps
  some values from: Physical Link
type: NamedIndividual
kb-reference: Reference-LibreNMSDocsNetworkMapExtension
maps: Network Node
maps: Physical Link
d3fend-id: D3-PLM
definition: Physical link mapping identifies and models the link connectivity of the network devices within a physical network.
synonym: Layer 1 Mapping

Physical Link Up Event
type: Class
subclass of: Physical Link Event
subclass of: Restriction
  on property: preceded-by
  some values from: Physical Link Connect Event
subclass of: Restriction
  on property: precedes
  some values from: Physical Link Down Event
definition: Auto-negotiation and signal detection complete; carrier is present and the link can forward frames.

Physical Location
type: Class
subclass of: D3FEND Core
type: NamedIndividual
definition: The terms location [here, a physical location] and place in geography are used to identify a point or an area on the Earth's surface or elsewhere. The term location generally implies a higher degree of certainty than place, which often indicates an entity with an ambiguous boundary, relying more on human or social attributes of place identity and sense of place than on geometry. The distinction between space and place is considered a central concern of geography, and has been addressed by scholars such as Yi-Fu Tuan and John Agnew.

Pipe
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: In Unix-like computer operating systems, a pipeline is a mechanism for inter-process communication using message passing. In the strictest sense, a pipe is a single segment of a pipeline, allowing one process to pass information forward to another. Network pipes allow processes on different hosts to interact.
alternative label: Pipeline

Pix2Pix
type: Class
subclass of: Image-to-Image Translation GAN
type: NamedIndividual
d3fend-id: D3A-PIX
kb-article: ## References Esri. (n.d.). How Pix2Pix Works. [Link](https://developers.arcgis.com/python/guide/how-pix2pix-works/)
definition: Pix2Pix is based on condtional GAN architecture and are trained on paired set of images or scenes from two domains to be used for translation.

Plan
type: Class
subclass of: D3FEND Core

Planning
type: Class
subclass of: Analytical Purpose

Platform Hardening
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Harden
type: NamedIndividual
enables: Harden
d3fend-id: D3-PH
definition: Hardening components of a Platform with the intention of making them more difficult to exploit. Platforms includes components such as: * BIOS UEFI Subsystems * Hardware security devices such as Trusted Platform Modules * Boot process logic or code * Kernel software components
synonym: Endpoint Hardening
synonym: System Hardening

Platform Monitoring
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Detect
type: NamedIndividual
enables: Detect
d3fend-id: D3-PM
kb-article: Platform monitoring consists of the analysis and monitoring of system level devices and low-level components, including hardware devices, to detect unauthorized modifications or suspicious activity. Monitored platform components includes system files and embedded devices such as: * Kernel software modules * Boot process code and load logic * Operating system components and device files * System libraries and dynamically loaded files * Hardware device drivers * Embedded firmware devices
definition: Monitoring platform components such as operating systems software, hardware devices, or firmware.

Point-biserial Correlation Coefficient
type: Class
subclass of: Correlation
type: NamedIndividual
d3fend-id: D3A-PBCC
definition: The point biserial correlation coefficient (rpb) is a correlation coefficient used when one variable (e.g. Y) is dichotomous; Y can either be "naturally" dichotomous, like whether a coin lands heads or tails, or an artificially dichotomized variable.
kb-article: ## References Wikipedia. (n.d.). Point-biserial correlation coefficient. [Link](https://en.wikipedia.org/wiki/Point-biserial_correlation_coefficient)

Point Estimation
type: Class
subclass of: Estimation
type: NamedIndividual
d3fend-id: D3A-PE
kb-article: ## References Pennsylvania State University. (n.d.). Statistical Inference and Estimation. [Link](https://online.stat.psu.edu/stat504/lesson/statistical-inference-and-estimation)
definition: A point estimation is a single value that estimates the parameter. Point estimates are single values calculated from the sample

Pointer
type: Class
subclass of: Digital Information
type: NamedIndividual
definition: In computer science, a pointer is a programming language object, whose value refers to (or "points to") another value stored elsewhere in the computer memory using its memory address. A pointer references a location in memory, and obtaining the value stored at that location is known as dereferencing the pointer. As an analogy, a page number in a book's index could be considered a pointer to the corresponding page; dereferencing such a pointer would be done by flipping to the page with the given page number.

Pointer Authentication
type: Class
subclass of: Application Hardening
subclass of: Restriction
  on property: authenticates
  some values from: Pointer
type: NamedIndividual
authenticates: Pointer
kb-reference: Reference-PointerAuthenticationOnARMv8.3
kb-reference: Reference-PointerAuthenticationProjectZero
d3fend-id: D3-PAN
definition: Comparing the cryptographic hash or derivative of a pointer's value to an expected value.
kb-article: ## How It Works Pointer Authentication (frequently referred to as PAC, although the technique is properly Pointer Authentication) is a security feature to provide protection against attackers with memory read/write access. A Pointer Authentication Code (PAC) is a cryptographic hash or derivative computed on the value of a pointer and some additional context information which can then provide a cryptographically strong guarantee about the likelihood that a pointer has been tampered with by an attacker. Although pointers are 64 bits, most systems have a substantially smaller virtual address space, leaving unused bits in pointers that can store the value of the PAC, this can be done to reduce memory space requirements. One implementation is in ARMv8.3-A. A PAC is computed over the 64-bit pointer value and a 64-bit context value. Instructions are introduced to deal with pointers: one category to compute and insert the PAC into a pointer, another category to verify the pointer and invalidate the pointer if the PAC does not check, and a third category to remove the pointer and restore the original value without verifying. The ARM standard specifies a cryptographic algorithm called QARMA-64 (designed by Qualcomm) to compute the signature, although this algorithm is not required. The architecture provides for five secret 128-bit Pointer Authentication keys: two for instruction pointers, two for data pointers, and a general key for signing larger blocks of data. ## Considerations In the ARM implementation, the mechanisms above for manipulating PACS are provided, but it is up to the code developer to manage the keys for the cryptographic algorithm. A known potential limitation of PACs concerns signing gadgets. Under certain circumstances PACs can be bypassed by forcing the system to run a signing gadget which will allow the signing of arbitrary pointers to occur.

Pointer Dereferencing Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: addresses
  some values from: Memory Block
subclass of: Restriction
  on property: addresses
  some values from: Pointer
type: NamedIndividual
addresses: Memory Block
addresses: Pointer
definition: A function which has an operation which dereferences a pointer.
comment: Note, this is not the actual code which performs the dereferencing operation internal to an application runtime.

Pointer Validation
type: Class
subclass of: Source Code Hardening
type: NamedIndividual
kb-reference: Reference-PointerValidationFunction SEI
d3fend-id: D3-PV
definition: Ensuring that a pointer variable has the required properties for use.

Policy Gradient
type: Class
subclass of: Model-free Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-PG
kb-article: ## References Policy Gradients in a Nutshell. Towards Data Science. [Link](https://towardsdatascience.com/policy-gradients-in-a-nutshell-8b72f9743c5d).
definition: The objective of a Reinforcement Learning Policy Gradient agent is to maximize the “expected” reward when following a policy

Policy Reference
type: Class
subclass of: Technique Reference
pref-label: Policy

PowerShell Profile Script
type: Class
subclass of: UserInitScript
type: NamedIndividual
definition: A PowerShell profile script is a script that runs when PowerShell starts and can be used as a logon script to customize user environments.

Power Supply
type: Class
subclass of: Hardware Device
definition: A power supply is an electrical device or module that converts and regulates energy from a source (e.g., the power grid or batteries) to an appropriate voltage, current, and frequency for one or more loads. It may stand alone or be integrated into its host appliance, often providing overcurrent protection, voltage regulation, or power conditioning for safe, stable operation.

Power and Thermal Device Event
type: Class
subclass of: Hardware Device Event
subclass of: Restriction
  on property: has-participant
  some values from: Sensor
definition: An event involving power supplies, batteries, or thermal management devices. These events represent changes in power states, temperature thresholds, or cooling system activity.

Pre-Authentication Event
type: Class
subclass of: Authentication Event
subclass of: Restriction
  on property: precedes
  some values from: Authentication
definition: An event representing preparatory steps or processes conducted prior to the primary authentication operation. Pre-authentication often involves initial protocol exchanges, cryptographic challenges, or the validation of supplemental factors (e.g., pre-shared keys) to ensure the readiness and security of the authentication workflow.

Predicate Logic
type: Class
subclass of: Symbolic AI
type: NamedIndividual
d3fend-id: D3A-PL
definition: Predicate logic is is collection of formal systems used in mathematics, philosophy, linguistics, and computer science. First-order logic and Higher-order logic both incorporate predicate logic.
kb-article: ## References 1. First-order logic. (2023, May 26). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/First-order_logic) 2. Higher-order logic. (2023, May 13) [Link](https://en.wikipedia.org/wiki/Higher-order_logic)

Primary Storage
type: Class
subclass of: Hardware Device
subclass of: Storage
subclass of: Restriction
  on property: contains
  some values from: Page Frame
subclass of: Restriction
  on property: contains
  some values from: Process Segment
type: NamedIndividual
contains: Page Frame
contains: Process Segment
definition: Primary memory of a computer is memory that is wired directly to the processor, consisting of RAM and possibly ROM. These terms are used in contrast to mass storage devices and cache memory (although we may note that when a program accesses main memory, it is often actually interacting with a cache).

Principal Component Analysis
type: Class
subclass of: Multivariate Analysis
type: NamedIndividual
d3fend-id: D3A-PCA
synonym: PCA
definition: Principal components analysis (PCA) creates a new set of orthogonal variables that contain the same information as the original set. It rotates the axes of variation to give a new set of orthogonal axes, ordered so that they summarize decreasing proportions of the variation.
kb-article: ## References Wikipedia. (n.d.). Multivariate statistics. [Link](https://en.wikipedia.org/wiki/Multivariate_statistics)

Principal Components Analysis
type: Class
subclass of: Dimension Reduction
type: NamedIndividual
d3fend-id: D3A-PCA
kb-article: ## References Wikipedia. (n.d.). Principal component analysis. [Link](https://en.wikipedia.org/wiki/Principal_component_analysis)
definition: Principal Component Analysis (PCA) is a statistic-based method of identifying patterns in a large dataset while increasing interpretability and preserving information.

Print Server
type: Class
subclass of: Server
definition: A print server, or printer server, is a device that connects printers to client computers over a network. It accepts print jobs from the computers and sends the jobs to the appropriate printers, queuing the jobs locally to accommodate the fact that work may arrive more quickly than the printer can actually handle.

Private Key
type: Class
subclass of: Asymmetric Key
type: NamedIndividual
definition: A private key can be used to decrypt messages encrypted using the corresponding public key, or used to sign a message that can be authenticated with the corresponding public key.

Privilege Escalation Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Privilege Escalation
type: NamedIndividual
enables: Privilege Escalation

Privileged User Account
type: Class
subclass of: UserAccount
definition: A privileged account is a user account that has more privileges than ordinary users. Privileged accounts might, for example, be able to install or remove software, upgrade the operating system, or modify system or application configurations. They might also have access to files that are not normally accessible to standard users. Typical examples are root and administrator accounts. But there also service accounts, system accounts, etc. Privileged accounts are especially powerful, and should be monitored especially closely.

Probabilistic Logic
type: Class
subclass of: Symbolic AI
type: NamedIndividual
d3fend-id: D3A-PL
definition: Probabilistic logic extends traditional logic truth tables with probabilistic expressions.
kb-article: ## References 1. Probabilistic logic. (2023, June 5). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Probabilistic_logic)

Procedure
type: Class
subclass of: Plan
subclass of: Restriction
  on property: implements
  some values from: Technique
subclass of: Restriction
  on property: start
  all values from: Step

Process
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Process Image
subclass of: Restriction
  on property: instructed-by
  some values from: Software
subclass of: Restriction
  on property: may-execute
  some values from: Thread
subclass of: Restriction
  on property: process-image-path
  some values from: Executable Binary
subclass of: Restriction
  on property: process-user
  some values from: UserAccount
subclass of: Restriction
  on property: uses
  some values from: Resource
subclass of: Restriction
  on property: process-command-line-arguments
  some values from: string
subclass of: Restriction
  on property: process-environmental-variables
  some values from: string
subclass of: Restriction
  on property: process-identifier
  some values from: integer
subclass of: Restriction
  on property: process-security-context
  some values from: string
type: NamedIndividual
contains: Process Image
instructed-by: Software
may-execute: Thread
process-image-path: Executable Binary
process-user: UserAccount
uses: Resource
definition: A process is an instance of a computer program that is being executed. It contains the program code and its current activity. Depending on the operating system (OS), a process may be made up of multiple threads of execution that execute instructions concurrently. A computer program is a passive collection of instructions, while a process is the actual execution of those instructions. Several processes may be associated with the same program; for example, opening up several instances of the same program often means more than one process is being executed.

Process Access Event
type: Class
subclass of: Process Event
subclass of: Restriction
  on property: preceded-by
  some values from: Process Creation Event
definition: An event where one process interacts with another, such as reading memory, inspecting state, or altering behavior.

Process Analysis
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Detect
type: NamedIndividual
enables: Detect
d3fend-id: D3-PA
definition: Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.

Process Code Segment
type: Class
subclass of: Process Segment
subclass of: Restriction
  on property: contains
  some values from: Subroutine
subclass of: Restriction
  on property: may-contain
  some values from: Process Segment
type: NamedIndividual
contains: Subroutine
may-contain: Process Segment
definition: A process code segment, also known as a text segment or simply as text, is a portion of the program's virtual address space that contains executable instructions and corresponds to the loaded image code segment. Includes additional sections such as an import table.
alternative label: Process Text Segment

Process Code Segment Verification
type: Class
subclass of: Process Analysis
subclass of: Restriction
  on property: verifies
  some values from: Process Code Segment
type: NamedIndividual
kb-reference: Reference-Anti-tamperSystemWithSelf-adjustingGuards ARXANTECHNOLOGIESInc
kb-reference: Reference-GuardsForApplicationInSoftwareTamperproofing PurdueResearchFoundation
kb-reference: Reference-SystemAndMethodForDetectingMalwareInjectedIntoMemoryOfAComputingDevice EndgameInc
kb-reference: Reference-SystemAndMethodForValidatingIn-memoryIntegrityOfExecutableFilesToIdentifyMaliciousActivity EndgameInc
kb-reference: Reference-TamperProofMutatingSoftware ARXANTECHNOLOGIESInc
kb-reference: Reference-ThreatDetectionThroughTheAccumulatedDetectionOfThreatCharacteristics SophosLtd
verifies: Process Code Segment
d3fend-id: D3-PCSV
kb-article: ## How it works A process code segment is an executable portion of computer memory allocated to a particular process. Process Code Segment Verification implements verification to compare a process code segment to some expected value. ### Verification logic Verification can occur during application startup, or continuously during execution. The logic which verifies the process code may be separate in a third-party process, embedded in the application itself at compile time, or dynamically linked at runtime. ### System of record Examples of systems of record: * On-disk application binary files or checksums * Remotely stored binary data or checksums * Embedded binary data or checksums ### Post Verification Actions If the verification function determines a process code segment may have been altered, a capability may invoke Eviction techniques as **Process Termination** to end the current process, or **Executable Blacklisting** to prevent the executable from launching in the future. ## Considerations ### False positives False positives commonly occur in the case that the layout of code in the process segment is legitimately modified: * Operating system features or third-party security software may modify the layout of process code, for example in the defensive technique **Segment Address Offset Randomization**, or in the case that a module is rebased. In both of these cases, the alteration occurs before the code is fully loaded into memory, and it would be possible to avoid the false positive by securely feeding this constant offset and any relocation data into the verification logic. * Process code segments may be written to modify themselves or other process code segments; however, this goes against widely-accepted current practices in software development. ### False negatives False negatives can occur via alteration of the verification logic or source of truth, or insufficient verification logic. * Verification techniques which are executed only locally may be defeate…
definition: Comparing the "text" or "code" memory segments to a source of truth.

Process Creation Event
type: Class
subclass of: Process Event
subclass of: Restriction
  on property: has-participant
  some values from: Process Start Function
definition: An event where a new process is spawned, initializing its execution context and resource allocation.

Process Data Segment
type: Class
subclass of: Process Segment
definition: A process data segment, is a portion of the program's virtual address space that contains executable instructions and corresponds to the loaded image data segment.

Process Environment Variable
type: Class
subclass of: Application Configuration
type: NamedIndividual
alternative label: Environment Variable
definition: An environment variable is a dynamic-named value that can affect the way running processes will behave on a computer. They are part of the environment in which a process runs.

Process Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Process
definition: An event capturing lifecycle transitions, interactions, or activities of computer processes, including their creation, termination, and inter-process communication.

Process Eviction
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Evict
type: NamedIndividual
enables: Evict
kb-reference: Reference-MalwareDetectionUsingLocalComputationalModels CrowdstrikeInc
d3fend-id: D3-PE
definition: Process eviction techniques terminate or remove running process.

Process Image
type: Class
subclass of: Computing Image
subclass of: Restriction
  on property: contains
  some values from: Process Segment
type: NamedIndividual
contains: Process Segment
definition: A process image is a copy of a given process's state at a given point in time. It is often used to create persistence within an otherwise volatile system.

Process Lineage Analysis
type: Class
subclass of: Process Spawn Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Process
subclass of: Restriction
  on property: analyzes
  some values from: Process Tree
type: NamedIndividual
analyzes: Process
analyzes: Process Tree
kb-reference: Reference-CommandLaunchedFromWinLogon MITRE
kb-reference: Reference-DebuggersForAccessibilityApplications MITRE
kb-reference: Reference-GenericRegsvr32 MITRE
kb-reference: Reference-OutlierParentsOfCmd MITRE
kb-reference: Reference-ProcessesSpawningCmd.exe MITRE
kb-reference: Reference-QuickExecutionOfASeriesOfSuspiciousCommands MITRE
kb-reference: Reference-Reg.exeCalledFromCommandShell MITRE
kb-reference: Reference-RemotelyLaunchedExecutablesViaWMI MITRE
kb-reference: Reference-ServiceOutlierExecutables MITRE
kb-reference: Reference-ServiceSearchPathInterception MITRE
kb-reference: Reference-ServicesLaunchingCmd MITRE
kb-reference: Reference-SystemAndMethodsThereofForCausalityIdentificationAndAttributionsDeterminationOfProcessesInANetwork PaloAltoNetworksIncCyberSecdoLtd
kb-reference: Reference-SystemAndMethodsThereofForIdentificationOfSuspiciousSystemProcesses PaloAltoNetworksInc
kb-reference: Reference-UACBypass MITRE
kb-reference: Reference-CAR-2020-11-002:LocalNetworkSniffing MITRE
kb-reference: Reference-CAR-2020-11-004:ProcessesStartedFromIrregularParent MITRE
kb-reference: Reference-CAR-2021-02-002:GetSystemElevation MITRE
kb-reference: Reference-CAR-2021-05-003:BCDEditFailureRecoveryModification MITRE
d3fend-id: D3-PLA
definition: Identification of suspicious processes executing on an end-point device by examining the ancestry and siblings of a process, and the associated metadata of each node on the tree, such as process execution, duration, and order relative to siblings and ancestors.
synonym: Process Tree Analysis
kb-article: ## How it works Process tree analysis techniques gather information on how a process was initiated to determine if a process is malicious. For example, if a process was not initiated from boot or not initiated by another process, that process is identified as suspicious. Also, if a new process was started before a process initiated by the device (ex. during boot) and that new process was not initiated by a user (which can be determined by examining process parameters such as type of process, its creator, source, etc.) the process is identified as suspicious. For example, Microsoft Word may block execution of any subprocess that is not in an approved path. ## Considerations * Attackers may spoof the parent PID (https://attack.mitre.org/techniques/T1502/), rendering such after-the-fact analysis on process lineage ineffective. * Processes may hide from various means of detection; an example on Linux is where a rootkit might remove key files for the process from its directory in /proc. * Zombie processes.

Process Segment
type: Class
subclass of: Binary Segment
type: NamedIndividual
definition: Process segments are distinct partitions of the memory space of a running process. Heap, data, code, and stack segments are examples of process segments.
synonym: Process Memory

Process Segment Execution Prevention
type: Class
subclass of: Application Hardening
subclass of: Restriction
  on property: neutralizes
  some values from: Process Segment
type: NamedIndividual
kb-reference: Reference-DataExecutionPrevention Microsoft
kb-reference: Reference-WhatIsNX XDFeature RedHat
neutralizes: Process Segment
d3fend-id: D3-PSEP
kb-article: ## How it works During execution of a process, the instruction pointer register should only point to addresses in a code segment (also called the .text segment), as this is the sole segment which should contain program code. When this technique detects an attempt to execute something that has been designated as non-executable, other techniques such as those in **Process Eviction** might be invoked, such as **Process Termination** to end the current process, or **Executable Blacklisting** to blacklist the potentially vulnerable or malfunctioning executable. ### Software-based implementations The software-based implementation in Windows XP SP2 might not check that every time the instruction pointer is changed, and does not check on each jump or return. Before calling an exception handler, Windows XP SP2 software-enforced DEP checks whether the exception handler is located in a memory region marked as executable. If the program was also built with SafeSEH, this implementation also checks before changing control to the exception handler whether it is a registered exception handler in the program's file on disk. ### Hardware-based implementations The NX (No Execute) or XD (Execute Disable) bit on the processor specifies whether a certain part of memory is executable. Early implementations set this bit by the memory segment, while modern implementations which are built on the flat memory model often store this bit in each entry of the page table, to control execution by the page. ## Considerations Non-hardware process data segment execution prevention is more susceptible to being able to be turned off for a page of memory. Different implementations of this defense have been in place since the 1980s, but implementation stalled when larger 16-bit programs began stuffing code in the segments usually reserved for data. Many modern programs follow the best practice of separation of code and data, are able to run under this defense. ROP or ret2libc/return-to-function attacks co…
synonym: No Execute
definition: Preventing execution of any address in a memory region other than the code segment.
synonym: Execute Disable

Process Self-Modification Detection
type: Class
subclass of: Process Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Process
type: NamedIndividual
analyzes: Process
kb-reference: Reference-SystemAndMethodForProcessHollowingDetection CarbonBlackInc
d3fend-id: D3-PSMD
definition: Detects processes that modify, change, or replace their own code at runtime.
kb-article: ## How it Works A security agent installed on the host machine intercepts API calls between a process and operating system. Intercepted API calls are then compared against attack signatures/patterns to identify API calls that modify executable memory or modify the entry point address of a suspended child process. Attack patterns include: * Executable code of a suspended child process removed from memory by one or more API calls. * New executable code injected and / or loaded into memory of a suspended child process by one or more API calls. * Executable code modified by one or more API calls. * Next instruction pointer value in memory modified by one or more API calls. ## Considerations Comparing loaded code segments of processes with what is expected to have been loaded from a file can result in false positives, due to legitimate uses of self-modification for decrypting or uncompressing code segments.

Process Set User ID Event
type: Class
subclass of: Process Event
subclass of: Restriction
  on property: preceded-by
  some values from: Process Creation Event
definition: An event where a process changes or adopts a specific user identity, modifying its access privileges or operational context.

Process Spawn Analysis
type: Class
subclass of: Process Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Create Process
subclass of: Restriction
  on property: analyzes
  some values from: Process
type: NamedIndividual
analyzes: Create Process
analyzes: Process
kb-reference: Reference-ActiveDirectoryDumpingViaNTDSUtil MITRE
kb-reference: Reference-CommandLineUsageOfArchivingSoftware MITRE
kb-reference: Reference-CreateRemoteProcessViaWMIC MITRE Other
kb-reference: Reference-CredentialDumpingViaMimikatz MITRE
kb-reference: Reference-HostDiscoveryCommands MITRE
kb-reference: Reference-LsassProcessDumpViaProcdump MITRE
kb-reference: Reference-PowershellExecution MITRE
kb-reference: Reference-RunDLL32.exeMonitoring MITRE
kb-reference: Reference-Squiblydoo MITRE
kb-reference: Reference-SuspiciousArguments MITRE
kb-reference: Reference-SuspiciousRunLocations MITRE
kb-reference: Reference-CAR-2020-04-001:ShadowCopyDeletion MITRE
kb-reference: Reference-CAR-2020-05-003:RareLolBASCommandLines MITRE
kb-reference: Reference-CAR-2020-08-001:NTFSAlternateDataStreamExecution-SystemUtilities MITRE
kb-reference: Reference-CAR-2020-09-003:IndicatorBlocking-DriverUnloaded MITRE
kb-reference: Reference-CAR-2020-09-004:CredentialsInFiles&Registry MITRE
kb-reference: Reference-CAR-2020-11-001:BootOrLogonInitializationScripts MITRE
kb-reference: Reference-CAR-2020-11-003:DLLInjectionWithMavinject MITRE
kb-reference: Reference-CAR-2020-11-005:ClearPowershellConsoleCommandHistory MITRE
kb-reference: Reference-CAR-2020-11-006:LocalPermissionGroupDiscovery MITRE
kb-reference: Reference-CAR-2020-11-007:NetworkShareConnectionRemoval MITRE
kb-reference: Reference-CAR-2020-11-008:MSBuildAndMsxsl MITRE
kb-reference: Reference-CAR-2020-11-009:CompiledHTMLAccess MITRE
kb-reference: Reference-CAR-2021-01-002:UnusuallyLongCommandLineStrings MITRE
kb-reference: Reference-CAR-2021-01-003:ClearingWindowsLogsWithWevtutil MITRE
kb-reference: Reference-CAR-2021-01-004:UnusualChildProcessForSpoolsv.ExeOrConnhost.Exe MITRE
kb-reference: Reference-CAR-2021-01-006:UnusualChildProcessSpawnedUsingDDEExploit MITRE
kb-reference: Reference-CAR-2021-01-007:DetectingTamperingOfWindowsDefenderCommandPrompt MITRE
kb-reference: Reference-CAR-2021-01-008:DisableUAC MITRE
kb-reference: Reference-CAR-2021-01-009:DetectingShadowCopyDeletionViaVssadmin.exe MITRE
kb-reference: Reference-CAR-2021-02-001:Webshell-IndicativeProcessTree MITRE
kb-reference: Reference-CAR-2021-04-001:CommonWindowsProcessMasquerading MITRE
kb-reference: Reference-CAR-2021-05-001:AttemptToAddCertificateToUntrustedStore MITRE
kb-reference: Reference-CAR-2021-05-002:BatchFileWriteToSystem32 MITRE
kb-reference: Reference-CAR-2021-05-003:BCDEditFailureRecoveryModification MITRE
kb-reference: Reference-CAR-2021-05-004:BITSJobPersistence MITRE
kb-reference: Reference-CAR-2021-05-005:BITSAdminDownloadFile MITRE
kb-reference: Reference-CAR-2021-05-006:CertUtilDownloadWithURLCacheAndSplitArguments MITRE
kb-reference: Reference-CAR-2021-05-007:CertUtilDownloadWithVerifyCtlAndSplitArguments MITRE
kb-reference: Reference-CAR-2021-05-008:CertutilExeCertificateExtraction MITRE
kb-reference: Reference-CAR-2021-05-009:CertUtilWithDecodeArgument MITRE
kb-reference: Reference-CAR-2021-05-010:CreateLocalAdminAccountsUsingNetExe MITRE
d3fend-id: D3-PSA
kb-article: ## How it works Process attributes are established when an operating system spawns a new process. These attributes are analyzed to look for the presence or absence of specific values or patterns. Some attributes of interest are: - user - process name - image path - security content ## Considerations - Attackers can spoof the parent process identifier (PPID), which could bypass this defense to allow execution of a malicious process from an arbitrary parent process. - Attackers could have legitimately compromised any of the process properties, such as the user, to make the execution appear legitimate. - Location: If the full image path is not checked, there could be a conflict with an executable that appears earlier due to resolution involving the system environment path/classpath variable. - Parsing issues: If the raw command from a shell is analyzed, rather than the actual function call, it is important to identify the actual command being run from its arguments. In Windows, services with unquoted file paths containing spaces will try to use the first token as the executable and the rest as arguments -- and shift tokens to the executable until a valid one is found. - Some [operating systems](/dao/artifact/d3f:OperatingSystem) can spawn processes without forking.
definition: Analyzing spawn arguments or attributes of a process to detect processes that are unauthorized.

Process Start Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: invokes
  some values from: Create Process
type: NamedIndividual
invokes: Create Process
definition: A function creates a new computer process, usually by invoking a create process system call.

Process Suspension
type: Class
subclass of: Process Eviction
subclass of: Restriction
  on property: suspends
  some values from: Process
type: NamedIndividual
kb-reference: Reference-PsSuspend
suspends: Process
d3fend-id: D3-PS
kb-article: ## How it works A running process might be suspended to mitigate its immediate effects if it is exhibiting anomalous, unauthorized, or malicious behavior. Defenders may choose to suspend rather than terminate to analyze the process first and resume the process if deemed benign. ### System-provided functions #### Windows tools In Windows, the `PsSuspend` command line utility from the SysInternals Suite provides functionality to suspend processes on a local or remote system.
definition: Suspending a running process on a computer system.

Process Termination
type: Class
subclass of: Process Eviction
subclass of: Restriction
  on property: terminates
  some values from: Process
type: NamedIndividual
kb-reference: Reference-InstantProcessTerminationToolToRecoverControlOfAnInformationHandlingSystem DellProductsLP
kb-reference: Reference-MalwareDetectionUsingLocalComputationalModels CrowdstrikeInc
terminates: Process
d3fend-id: D3-PT
kb-article: ## How it works Processes are managed by the operating system kernel. Different operating system kernels manage the creation and termination of processes in a different manner, and expose this functionality via the kernel API. A running process might be terminated to mitigate its immediate effects if it is exhibiting anomalous, unauthorized, or malicious behavior; such as after detecting anomalous behavior via Administrative Network Activity Analysis, after a failed check from Stack Frame Canary Validation, or after System Call Analysis finds an attempt to execute an unauthorized system call. ### Proprietary technology Security software might use proprietary technology to terminate processes, instead of the system-provided functions. Further research may provide specific detail on such methods used. ### System-provided functions #### Windows tools In Windows, `ExitProcess()` is used to send a signal to a process to request it to exit, and `TerminateProcess()` is used to force a process to exit. The `taskkill` executable available in the cmd shell is used to kill a process, with the `/F` switch forcing termination as with `TerminateProcess()`. In PowerShell, `Stop-Process` is used, which is aliased by default to `spps` and `kill`. Processes started in the Windows Subsystem for Linux (WSL) environment may be terminated there with the `kill` command. In some cases, existing drivers can also be leveraged to kill processes. #### Unix/Linux tools In Unix-like systems, all process termination requests are handled using signals. The `kill` function takes the Process ID and signal to send, and is accessible with the `kill` command. Some shells have a `kill` builtin function which is separate than the `kill` binary, which can also kill background jobs in the shell and additionally perform the function faster, and can run from an existing instance of the shell if the process table is full. The signal SIGTERM specifies that the process to terminate may invoke a handler that it …
definition: Terminating a running application process on a computer system.

Process Termination Event
type: Class
subclass of: Process Event
subclass of: Restriction
  on property: preceded-by
  some values from: Process Creation Event
definition: An event marking the cessation of a process, including resource deallocation and cleanup, either due to normal completion or abnormal termination.

Process Tree
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: contains
  some values from: Process
type: NamedIndividual
contains: Process
definition: A process tree is a tree structure representation of parent-child relationships established via process spawn operations.

Processor
type: Class
subclass of: Hardware Device
definition: A processor is a hardware component or integrated circuit that performs computations, executes instructions, and processes data to carry out tasks within a computing system.
synonym: Computer Processor

Processor Component
type: Class
subclass of: Hardware Device
definition: A Processor Component is a functional subunit or module within a processor that performs specific tasks to support the processor's overall operation.

Processor Register
type: Class
subclass of: Primary Storage
subclass of: Restriction
  on property: contained-by
  some values from: Central Processing Unit
type: NamedIndividual
contained-by: Central Processing Unit
definition: A processor register is a quickly accessible location available to a computer's processor. Registers usually consist of a small amount of fast storage, although some registers have specific hardware functions, and may be read-only or write-only.

Product Developer
type: Class
subclass of: Provider
definition: A product developer intentionally designs, creates, or improves products, which may include physical goods, software, or other outputs.

Progressively Growing GAN
type: Class
subclass of: Image Synthesis GAN
type: NamedIndividual
d3fend-id: D3A-PGG
kb-article: ## References Machine Learning Mastery. (n.d.). Introduction to Progressive Growing Generative Adversarial Networks. [Link](https://machinelearningmastery.com/introduction-to-progressive-growing-generative-adversarial-networks/)
definition: Progressive Growing GAN (ProGAN) is an extension to the GAN training process that allows for the stable training of generator models that can output large high-quality images.
synonym: ProGAN

Projected Clustering
type: Class
subclass of: High-dimension Clustering
type: NamedIndividual
d3fend-id: D3A-PC
kb-article: ## References GeeksforGeeks. (n.d.). Projected Clustering in Data Analytics. [Link](https://www.geeksforgeeks.org/projected-clustering-in-data-analytics/)
definition: Projected clustering is a dimension reduction subspace clustering method.

Projection-based Clustering
type: Class
subclass of: High-dimension Clustering
type: NamedIndividual
d3fend-id: D3A-PBC
kb-article: ## References R Core Team. (2021). ProjectionBasedClustering: Projection Based Clustering. [Link](https://cran.r-project.org/web/packages/ProjectionBasedClustering/ProjectionBasedClustering.pdf) Lai, J. H., Liu, Y., & Wu, W. (2017). Projection Based Clustering. [Link](https://www.researchgate.net/publication/319006501_Projection_Based_Clustering)
definition: Projection Based Clustering is a clustering framework based on a chosen projection method and projection method a parameter-free high-dimensional data visualization technique.

Prolog
type: Class
subclass of: Logic Programming
type: NamedIndividual
d3fend-id: D3A-PRO
definition: Prolog has its roots in first-order logic, a formal logic, and unlike many other programming languages.
kb-article: ## How it works Prolog is intended primarily as a declarative programming language: the program logic is expressed in terms of relations, represented as facts and rules. A computation is initiated by running a query over these relations. ## References 1. Prolog. (2023, April 5). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Prolog)

Property List File
type: Class
subclass of: Configuration File
type: NamedIndividual
definition: In the OS X, iOS, NeXTSTEP, and GNUstep programming frameworks, property list files are files that store serialized objects. Property list files use the filename extension .plist, and thus are often referred to as p-list files. Property list files are often used to store a user's settings. They are also used to store information about bundles and applications, a task served by the resource fork in the old Mac OS.
alternative label: Plist File

Propositional Logic
type: Class
subclass of: Symbolic AI
type: NamedIndividual
d3fend-id: D3A-PL
kb-article: ## How it works Compound propositions are formed by connecting propositions by logical connectives. Propositions that contain no logical connectives are called atomic propositions. ## References 1. Propositional Calculus. (2022, May 31). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Propositional_calculus)
synonym: Propositional Calculus
definition: Propositional logic deals with statements (i.e., propositions, which can be true or false) and relations between propositions, including the construction of arguments based on them.

Protocol Metadata Anomaly Detection
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
type: NamedIndividual
analyzes: Network Traffic
kb-reference: Reference-MethodAndSystemForDetectingThreatsUsingMetadataVectors VECTRANETWORKSInc
kb-reference: Reference-MethodAndSystemForDetectingThreatsUsingPassiveClusterMapping VectraNetworksInc
kb-reference: Reference-SystemForImplementingThreatDetectionUsingDailyNetworkTrafficCommunityOutliers VECTRANETWORKSInc
d3fend-id: D3-PMAD
kb-article: ## How it works Network protocol metadata is first collected and processed in real-time or post-facto. Metadata may include packet header information or information about a session (ex. time between requests/responses). Metadata is then grouped based on shared characteristics and those groups are compared to each other. If particular metadata differs significantly from other data, an alert is generated, identifying the network event as anomalous. Anomalous activity may indicate unauthorized activity. ## Considerations Metadata collection on enterprises can yield large data sets. Storage, indexing, querying, and aging should be considered prior to implementation.
definition: Collecting network communication protocol metadata and identifying statistical outliers.

Provider
type: Class
subclass of: Organization
definition: Providers are entities that intentionally offer, supply, or facilitate goods, services, or resources through actions of their agents.

Proxy-based Web Server Access Mediation
type: Class
subclass of: WebSessionAccessMediation
type: NamedIndividual
kb-reference: Reference-NIST-Special-Publication-800-41-Revision-1
d3fend-id: D3-PBWSAM
kb-article: ## How it works Proxy-based Web Server Access Mediation involves controlling access to web servers via proxy servers, which act as intermediaries between users and web resources. This approach can enhance security by anonymizing user requests, filtering content, and enforcing access policies. Examples include using corporate proxies to access external websites or services.
definition: Proxy-based web server access mediation focuses on the regulation of web server access through intermediary proxy servers.

Proxy Server
type: Class
subclass of: Computer Network Node
subclass of: Server
definition: In computer networking, a proxy server is a server application or appliance that acts as an intermediary for requests from clients seeking resources from servers that provide those resources. A proxy server thus functions on behalf of the client when requesting service, potentially masking the true origin of the request to the resource server.

Public Key
type: Class
subclass of: Asymmetric Key
type: NamedIndividual
definition: A public key can be disseminated widely as part of an asymmetric cryptography framework and be used to encrypt messages to send to the public key's owner or to authenticate signed messages from that sender.

Python Package
type: Class
subclass of: Software Package
definition: A Python package is an aggregation of many Python files - either in source code or in bytecode - and associated metadata and resources (text, images, etc.). Python packages can be distributed in different file formats.

Python Script File
type: Class
subclass of: Executable Script
synonym: A script file written in the Python programming language.

Q-Learning
type: Class
subclass of: Model-free Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-QL
kb-article: ## References Q-learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Q-learning).
definition: Q-learning is a model-free reinforcement learning algorithm to learn the value of an action in a particular state. It does not require a model of the environment (hence "model-free"), and it can handle problems with stochastic transitions and rewards without requiring adaptations.

Query By Committee
type: Class
subclass of: Active Learning
type: NamedIndividual
d3fend-id: D3A-QBC
definition: Query by Committee (QBC) takes inspiration from ensemble methods. Instead of just one classifier, it takes into account the decision of a committee C=ℎ1,…,ℎc of classifiers ℎi. Each classifier has the same target classes, but a different underlying model or a different view on the data.
kb-article: ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).

RAM
type: Class
subclass of: Primary Storage
definition: Random-access memory (RAM) is a form of computer memory that can be read and changed in any order, typically used to store working data and machine code.
synonym: Random-access Memory

RDP Connect Request Event
type: Class
subclass of: RDP Event
definition: An event where an RDP client sends a connection request specifying session parameters, such as display settings, compression preferences, and security requirements, to prepare for an interactive session.

RDP Connect Response Event
type: Class
subclass of: RDP Event
subclass of: Restriction
  on property: preceded-by
  some values from: RDP Connect Request Event
definition: An event where an RDP server acknowledges a connection request, finalizing session parameters and confirming the transition to an interactive remote session.

RDP Event
type: Class
subclass of: Application Layer Event
subclass of: Class
  union of: TCP Event
  union of: UDPEvent
subclass of: Restriction
  on property: has-participant
  some values from: RDP Session
definition: An event involving the Remote Desktop Protocol (RDP), a communication protocol developed by Microsoft that facilitates secure remote access to graphical interfaces on desktops or applications hosted on remote servers. RDP supports multi-channel communication for transferring input, output, and management commands.

RDP Initial Request Event
type: Class
subclass of: RDP Event
definition: An event where an RDP client initiates communication with a server by sending a request to establish a session and negotiate protocol capabilities for remote interaction.

RDP Initial Response Event
type: Class
subclass of: RDP Event
subclass of: Restriction
  on property: preceded-by
  some values from: RDP Initial Request Event
definition: An event where an RDP server responds to an initial request from a client, presenting its supported capabilities and agreeing to proceed with session negotiation.

RDP Session
type: Class
subclass of: Remote Session
type: NamedIndividual
definition: A Remote Desktop Protocol (RDP) session is a session established using the RDP protocol to access Remove Desktop Services (RDS).
alternative label: Remote Desktop Session
alternative label: Terminal Services

RDP TLS Handshake Event
type: Class
subclass of: RDP Event
definition: An event representing the cryptographic exchange of keys and certificates between an RDP client and server to establish a secure communication channel. The handshake ensures encryption, integrity, and authentication for the session.

RF Node
type: Class
subclass of: Network Node
definition: An RF Node is a device or component that participates in the transmission, reception, or processing of radio frequency (RF) signals within a wireless communication system.

RF Receiver
type: Class
subclass of: RF Node
definition: An RF Receiver captures and processes incoming radio freqency signals.

RF Shielding
type: Class
subclass of: Platform Hardening
type: NamedIndividual
kb-reference: Reference-PrivacyAndSecuritySystemsAndMethodsOfUse
kb-reference: Reference-Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities
d3fend-id: D3-RFS
definition: Adding physical barriers to a platform to prevent undesired radio interference.

RF Transceiver
type: Class
subclass of: RF Node
definition: An RF Transceiver can send and receive RF signals - a combination of RF transmitter and RF receiver.

RF Transmitter
type: Class
subclass of: RF Node
type: NamedIndividual
definition: An RF Transmitter generates and sends RF signals.

ROM
type: Class
subclass of: Primary Storage
definition: Read-only memory (ROM) is a type of non-volatile memory used in computers and other electronic devices. Data stored in ROM cannot be electronically modified after the manufacture of the memory device. Read-only memory is useful for storing software that is rarely changed during the life of the system, also known as firmware.
synonym: Read-only Memory

RPC Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: RPC network traffic is network traffic related to remote procedure calls between network nodes..This includes only network traffic conforming to a standard RPC protocol; not custom protocols.

RPC Traffic Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: RPC Network Traffic
type: NamedIndividual
analyzes: RPC Network Traffic
kb-reference: Reference-CAR-2014-11-007-RemoteWindowsManagementInstrumentation WMI OverRPC MITRE
kb-reference: Reference-CreateRemoteProcessViaWMIC MITRE Other
kb-reference: Reference-RPCCallInterception CrowdstrikeInc
kb-reference: Reference-RemotelyLaunchedExecutablesViaServices MITRE
kb-reference: Reference-RemotelyLaunchedExecutablesViaWMI MITRE
kb-reference: Reference-RemotelyScheduledTasksViaSchtasks MITRE
kb-reference: Reference-SMBWriteRequest-NamedPipes MITRE
kb-reference: Reference-CAR-2014-05-001:RPCActivity MITRE
d3fend-id: D3-RTA
kb-article: ## How it works A remote procedure call (RPC) enables one computer to execute a specific function on another computer, as if it were a local application process. There are numerous RPC specifications and implementations. RPC capabilities can be abused by attackers in order to achieve a variety of tactical objectives including execution, persistence, initial access, and more. RPC proxies may be used to collect and store RPC traffic. RPCs can occur over network sockets or named pipes. Analytics look for unauthorized behavior such as: * Processes being launched or scheduled remotely * System configurations being changed remotely * Unauthorized file read activity Example RPC Protocols: * DCE/RPC * CORBA * Open Network Computing Remote Procedure Call * D-Bus * XML-RPC * JSON-RPC * SOAP * Apache Thrift ## Considerations * RPC is widely used in enterprise environments, and significant data filtering may be required in large environments to enable analytic processing. * RPC traffic may occur over a pipe, or within a host over loopback interface, thus making network collection difficult.
definition: Monitoring the activity of remote procedure calls in communication traffic to establish standard protocol operations and potential attacker activities.
synonym: RPC Protocol Analysis

RTSP Server
type: Class
subclass of: Network Audio Visual Streaming Resource
definition: A streaming server that utilizes the real-time streaming protocol.

Radio Modem
type: Class
subclass of: Modem
definition: A radio modem provides the means to send digital data wirelessly. Radio modems are used to communicate by direct broadcast satellite, WiFi, WiMax, mobile phones, GPS, Bluetooth and NFC. Modern telecommunications and data networks also make extensive use of radio modems where long distance data links are required. Such systems are an important part of the PSTN, and are also in common use for high-speed computer network links to outlying areas where fiber optic is not economical.

Random Forest
type: Class
subclass of: Bootstrap Aggregating
type: NamedIndividual
d3fend-id: D3A-RF
definition: Random Forest is a ML method that combines several other ML methods. At its core, Random Forest is an ensemble method of multiple bootstrapped decision trees filled with training data and random feature selection.
kb-article: ## References Random forest. Wikipedia. [Link](https://en.wikipedia.org/wiki/Random_forest).

Random Splits
type: Class
subclass of: Resampling Ensemble
type: NamedIndividual
d3fend-id: D3A-RS
definition: The dataset is repeatedly sampled with a random split of the data into train and test sets.
kb-article: ## References How to Create a Random Split Cross-Validation and Bagging Ensemble for Deep Learning in Keras."*Machine Learning Mastery*. [Link](https://machinelearningmastery.com/how-to-create-a-random-split-cross-validation-and-bagging-ensemble-for-deep-learning-in-keras/).

Range
type: Class
subclass of: Variability
type: NamedIndividual
d3fend-id: D3A-RAN
definition: The range of a set of data is the difference between the largest and smallest value.
kb-article: ## References Wikipedia. (n.d.). Range (statistics). [Link](https://en.wikipedia.org/wiki/Range_(statistics))

Range Matching
type: Class
subclass of: Numeric Pattern Matching
type: NamedIndividual
d3fend-id: D3A-RM
definition: Numeric Range Matching determines if a value lies with an interval of values (i.e., within the range of values.)

Rank Correlation
type: Class
subclass of: Correlation
type: NamedIndividual
d3fend-id: D3A-RC
kb-article: Wikipedia. (n.d.). Rank correlation. [Link](https://en.wikipedia.org/wiki/Rank_correlation)
definition: A rank correlation is any of several statistics that measure an ordinal association-the relationship between rankings of different ordinal variables or different rankings of the same variable, where a "ranking" is the assignment of the ordering labels "first", "second", "third", etc. to different observations of a particular variable.

Raw Memory Access Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: accesses
  some values from: Memory Block
type: NamedIndividual
accesses: Memory Block
definition: A function which accesses raw memory, usually using memory addresses.

Read File
type: Class
subclass of: System Call
subclass of: Restriction
  on property: reads
  some values from: File
type: NamedIndividual
reads: File
definition: A program that needs to access data from a file stored in a file system uses the read system call. The file is identified by a file descriptor that is normally obtained from a previous call to open. This system call reads in data in bytes, the number of which is specified by the caller, from the file and stores then into a buffer supplied by the calling process.

Read Memory
type: Class
subclass of: System Call
subclass of: Restriction
  on property: reads
  some values from: Memory Block
type: NamedIndividual
reads: Memory Block

Reconnaissance Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Reconnaissance
type: NamedIndividual
enables: Reconnaissance

Record
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: In computer science, a record (also called struct or compound data) is a basic data structure. A record is a collection of fields, possibly of different data types, typically in fixed number and sequence . The fields of a record may also be called members, particularly in object-oriented programming. Fields may also be called elements, though these risk confusion with the elements of a collection. A tuple may or may not be considered a record, and vice versa, depending on conventions and the specific programming language.

Recurrent Neural Network
type: Class
subclass of: Deep Neural Network Classification
type: NamedIndividual
d3fend-id: D3A-RNN
kb-article: ## References Wikipedia. (2021, September 7). Recurrent Neural Network. [Link](https://en.wikipedia.org/wiki/Recurrent_neural_network)
definition: Recurrent Nerual Networks (RNN) are a class of artificial neural networks where connections between nodes can create a cycle, allowing output from some nodes to affect subsequent input to the same nodes. This allows it to exhibit temporal dynamic behavior.

Reference Nullification
type: Class
subclass of: Source Code Hardening
subclass of: Restriction
  on property: hardens
  some values from: Memory Free Function
type: NamedIndividual
hardens: Memory Free Function
kb-reference: Reference-ReferenceNullification SecureSoftwareInc
d3fend-id: D3-RN
definition: Invalidating all pointers that reference a specific memory block, ensuring that the block cannot be accessed or modified after deallocation.
kb-article: ## How it Works Nullifying references to memory blocks makes those blocks no longer accessible. This is critical to prevent use-after-free errors. ## Considerations * If a memory block is freed, all other references to that block should be nullified. * This is particularly relevant when manually managing memory. * Note: This resource should not be considered a definitive or exhaustive coding guideline.

Regex Matching
type: Class
subclass of: Partial Matching
type: NamedIndividual
d3fend-id: D3A-RM
definition: Regular expression matching is type of partial string matching using a regular expression, which is a sequence of characters that specifies a match pattern in text.
synonym: Regexp
synonym: Regex
kb-article: ## How it works A regular expression (shortened as regex or regexp) is a sequence of characters that specifies a match pattern in text. Usually such patterns are used by string-searching algorithms for "find" or "find and replace" operations on strings, or for input validation. ## Key Test Considerations - **External review of regular expressions**: Regular expressions used in rules should be reviewed by a independent developer SME. Regex testing and visualization tools may be used to aid this review. Back-tests for failure modes identified during the review shoud be developed. Regular expressions are easy to get wrong and may appear to work on limited tests; small mistakes can lead to unintended misses and matches.] - **Processing Performance Review**: Review of resource-intensive rules may be necessary if system performance degraded. Look for cases of “exponential backtracking” Some regexes are computationally expensive. ## References 1. Regular expression. (2023, June 1). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Regular_expression). 2. String-searching algorithm. (2023, April 8). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/String-searching_algorithm).

Registry Key Deletion
type: Class
subclass of: Object Eviction
subclass of: Restriction
  on property: deletes
  some values from: WindowsRegistryKey
type: NamedIndividual
deletes: WindowsRegistryKey
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
d3fend-id: D3-RKD
definition: Delete a registry key.

Regression Analysis
type: Class
subclass of: Statistical Method
type: NamedIndividual
d3fend-id: D3A-RA
definition: Regression analysis is a set of statistical processes for estimating the relationships between a dependent variable (often called the 'outcome' or 'response' variable, or a 'label' in machine learning parlance) and one or more independent variables (often called 'predictors', 'covariates', 'explanatory variables' or 'features').
kb-article: ## References Wikipedia. (n.d.). Regression analysis. [Link](https://en.wikipedia.org/wiki/Regression_analysis)

Regression Analysis Learning
type: Class
subclass of: Supervised Learning
type: NamedIndividual
d3fend-id: D3A-RAL
definition: Regression is used to understand the relationship between dependent and independent variables which is then used to make projections, such as for sales revenue for a given business.
kb-article: ## References Supervised Learning. IBM. [Link](https://www.ibm.com/topics/supervised-learning).

Reinforcement Learning
type: Class
subclass of: Machine Learning
type: NamedIndividual
d3fend-id: D3A-RL
kb-article: ## References Reinforcement learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Reinforcement_learning).
definition: Reinforcement Learning is a subjugate technique of machine learning that uses feedback to reinforce good or valid rules and lessen the reliance of bad or ineffective rules

Reissue Credential
type: Class
subclass of: Restore Access
subclass of: Restriction
  on property: restores
  some values from: Credential
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Credential
d3fend-id: D3-RIC
definition: Issue a new credential to a user which supercedes their old credential.

Relational-based Transfer Learning
type: Class
subclass of: Homogenous Transfer Learning
type: NamedIndividual
d3fend-id: D3A-RBTL
kb-article: ## References V7 Labs. (n.d.). Transfer Learning Guide. [Link](https://www.v7labs.com/blog/transfer-learning-guide#:~:text=Relational%2Dbased%20transfer%20learning%20approaches,domain%20to%20the%20target%20domain).
definition: Relational-based Transfer Learning is a subfield of machine learning where knowledge and patterns learned from one domain, characterized by relational and structured data, are transferred to enhance the learning of another related domain. This approach leverages shared concepts, relations, and structures across domains, taking advantage of the rich semantic knowledge within relational data to improve learning performance in the target task.

Relay Pattern Analysis
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
analyzes: Outbound Internet Network Traffic
kb-reference: Reference-MaliciousRelayDetectionOnNetworks VECTRANETWORKSInc
d3fend-id: D3-RPA
kb-article: ## How it works A relay may use a variety of proxying, forwarding, or routing technologies to bridge a protected network with an external network. A defensive analytic to detect a relay network may compare the network sessions among multiple hosts. Hosts which have nearly similar network statistics may be part of a relay network. The statistics may include number of bytes sent to and from, time of session initiation, packet size, or packet arrival time data. ## Considerations Complex intranet VPNs or routing encapsulation may affect the detection analytics. In addition, unwanted packets might not be forwarded, and additional packets may be added at the relay, further complicating detection.
synonym: Relay Network Detection
definition: The detection of an internal host relaying traffic between the internal network and the external network.

Remote Attacker
type: Class
subclass of: Attacker
definition: An attacker who exploits systems without being physically present near the target, often over the internet.

Remote Authentication Service
type: Class
subclass of: Authentication Service
subclass of: Network Service
definition: A remote authentication service provides for the authentication of a user across a network (i.e., remotely).

Remote Authorization Service
type: Class
subclass of: Authorization Service
definition: A remote authorization service provides for the authorization of a user across a network (i.e., remotely).

Remote Command
type: Class
subclass of: Command
definition: A remote command is a command sent from one computer to another to be executed on the remote computer. One example of this, is through a command-line interface (CLI) like using Invoke-Command from PowerShell or a command sent through an ssh session. This class generalizes to all means of sending a command through an established protocol to control capabilities on a remote computer.

Remote Database Query
type: Class
subclass of: Database Query
subclass of: Remote Command
definition: A remote query session enabling a user to make an SQL, SPARQL, or similar query over the network from one host to another.

Remote File Access Mediation
type: Class
subclass of: Network Resource Access Mediation
subclass of: Restriction
  on property: isolates
  some values from: File
type: NamedIndividual
isolates: File
kb-reference: Reference-NIST-Special-Publication-800-53-Revision-5
d3fend-id: D3-RFAM
kb-article: ## How it works Remote File Access Mediation focuses on controlling how users or processes access file systems from remote locations. This involves ensuring secure connections, often through protocols like SFTP or SMB, and enforcing permissions to prevent unauthorized access or data breaches. Examples of enforcement areas include accessing shared drives or cloud storage from remote offices or home networks.
definition: Remote file access mediation is the process of managing and securing access to file systems over a network to ensure that only authorized users or processes can interact with remote files.
synonym: File Share Access Mediation

Remote Login Session
type: Class
subclass of: Network Session
definition: A remote login session is a login session where a client has logged in from their local host machine to a server via a network.

Remote Procedure Call
type: Class
subclass of: Remote Command
definition: In distributed computing a remote procedure call (RPC) is when a computer program causes a procedure (subroutine) to execute in another address space (commonly on another computer on a shared network), which is coded as if it were a normal (local) procedure call, without the programmer explicitly coding the details for the remote interaction. That is, the programmer writes essentially the same code whether the subroutine is local to the executing program, or remote. This is a form of client-server interaction (caller is client, executor is server), typically implemented via a request-response message-passing system. The object-oriented programming analog is remote method invocation (RMI). The RPC model implies a level of location transparency.

Remote Resource
type: Class
subclass of: Resource
definition: In computing, a remote resource is a computer resource made available from one host to other hosts on a computer network. It is a device or piece of information on a computer that can be remotely accessed from another computer, typically via a local area network or an enterprise intranet.

Remote Session
type: Class
subclass of: Network Session
type: NamedIndividual
definition: A remote login session is a login session where a client has logged in from their local host machine to a server via a network.

Remote Terminal Session
type: Class
subclass of: Network Session
definition: A remote terminal session is a session that provides a user access from one host to another host via a terminal.

Remote Terminal Session Detection
type: Class
subclass of: Network Traffic Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
type: NamedIndividual
analyzes: Network Traffic
kb-reference: Reference-MethodAndSystemForDetectingExternalControlOfCompromisedHosts VECTRANETWORKSInc
kb-reference: Reference-RDPConnectionDetection MITRE
kb-reference: Reference-RemoteDesktopLogon MITRE
d3fend-id: D3-RTSD
kb-article: ## How it works An external attacker takes remote control of a host inside a company or organization's network and manually directs offensive techniques. Nonstandard terminal sessions and abnormal behaviors are analyzed in this technique. Abnormal behavior detection includes analysis of user input patterns in the real-time session, keyboard output and packet inspection. ### Network Traffic Inspection Network traffic from internal hosts is the main concern and focus for the traffic inspection. The network traffic is collected into inspection groups. The groups of traffic are assembled into distinct pair flows (outbound/inbound) and the pair flows are further divided into sessions. Only sessions originated inside of the network are considered for the inspection. Traffic inspection includes analysis to determine if a human is involved in the session exchanges. Time-based statistics are captured for each session being analyzed by the detection engine. ### Algorithm Analysis Description Analysis algorithms look for patterns in the network traffic captured from the session data. A detection engine groups the session traffic data, between the hosts, into rapid exchange instances. Analysis of rapid exchange traffic patterns can lead to the discovery of abnormal behavior which is indicative of a compromised internal host. The analysis algorithms look for patterns in the traffic which correlate to known activity (e.g., relay attacks, bot activity, bitcoin mining). Some metrics used during inspection include the following. * Number of rapid-exchange instances * Time interval between packets * Fixed cadence of traffic * Rhythm and direction of the initiation of instances * Volume of data flowing from internal to external controlling host * Data transfer characteristics * Variability in length of silent periods ## Considerations * Full packet capture is required which can be process intensive to analyze * Attackers that move low and slow may blend in with existing traffic result…
definition: Detection of an unauthorized remote live terminal console session by examining network traffic to a network host.

Removable Media Device
type: Class
subclass of: Hardware Device
type: NamedIndividual
definition: A removable media device is a hardware device used for computer storage and that is designed to be inserted and removed from the system. It is distinct from other removable media in that all the hardware required to read the data are built into the device. So USB flash drives and external hard drives are removable media devices, whereas tapes and disks are not, as they require additional hardware to perform read/write operations.

Remove User from Group Event
type: Class
subclass of: Group Management Event
subclass of: Restriction
  on property: has-participant
  some values from: UserAccount
subclass of: Restriction
  on property: preceded-by
  some values from: Add User to Group Event
definition: An event where a user is removed from a group, revoking the permissions and privileges associated with the group from the user.

Repository
type: Class
subclass of: Digital Information Bearer
definition: A centralized digital storage location where code, files, and related resources are systematically organized, managed, and maintained.

Resampling Ensemble
type: Class
subclass of: Ensemble Learning
type: NamedIndividual
d3fend-id: D3A-RE
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning). Torgo, L. (2014). A resampling ensemble algorithm for improved accuracy. *Neurocomputing*, 134, 55-66. [Link](https://www.sciencedirect.com/science/article/pii/S0925231214007644#:~:text=A%20resampling%20ensemble%20algorithm%20is,and%20undersampling%20are%20empirically%20analyzed).
definition: In the method, the small classes are oversampled and large classes are undersampled. The resampling scale is determined by the ratio of the min class number and max class number. And multiple machine learning methods are selected to construct the ensemble

Residual Neural Network
type: Class
subclass of: Convolutional Neural Network
type: NamedIndividual
d3fend-id: D3A-RNN
definition: A residual neural network (ResNet) is an artificial neural network (ANN). It is a gateless or open-gated variant of the HighwayNet, the first working very deep feedforward neural network with hundreds of layers, much deeper than previous neural networks.
kb-article: ## References Wikipedia contributors. (2021, August 23). Residual neural network. In Wikipedia, The Free Encyclopedia. [Link](https://en.wikipedia.org/wiki/Residual_neural_network)

Resource
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: In computing, a system resource, or simply resource, is any physical or virtual component of limited availability within a computer system. Every device connected to a computer system is a resource. Every internal system component is a resource. Virtual system resources include files (concretely file handles), network connections (concretely network sockets), and memory areas. Managing resources is referred to as resource management, and includes both preventing resource leaks (releasing a resource when a process has finished using it) and dealing with resource contention (when multiple processes wish to access a limited resource).

Resource Access
type: Class
subclass of: UserAction
type: NamedIndividual
definition: Ephemeral digital artifact comprising a request of a resource and any response from that resource.

Resource Access Pattern Analysis
type: Class
subclass of: UserBehaviorAnalysis
subclass of: Restriction
  on property: analyzes
  some values from: Authentication
subclass of: Restriction
  on property: analyzes
  some values from: Authorization
type: NamedIndividual
analyzes: Authentication
analyzes: Authorization
kb-reference: Reference-HostIntrusionPreventionSystemUsingSoftwareAndUserBehaviorAnalysis SophosLtd
kb-reference: Reference-MethodAndApparatusForNetworkFraudDetectionAndRemediationThroughAnalytics IdaptiveLLC
kb-reference: Reference-ModelingUserAccessToComputerResources DaedalusGroupLLC
kb-reference: Reference-SystemAndMethodThereofForIdentifyingAndRespondingToSecurityIncidentsBasedOnPreemptiveForensics PaloAltoNetworksInc
kb-reference: Reference-System,Method,AndComputerProgramProductForDetectingAndAssessingSecurityRisksInANetwork ExabeamInc
d3fend-id: D3-RAPA
kb-article: ## How it works This technique analyzes a user's resource accesses by comparing the user's recent activity against a baseline activity model. Major differences between the current activity and the baseline model might indicate unauthorized activity if they are severe enough. ## Considerations * Potential for false positives from anomalies that are not associated with malicious activity. * Attackers that move low and slow may not differentiate their resource access activity behavior enough to trigger an alert.
definition: Analyzing the resources accessed by a user to identify unauthorized activity.

Resource Development Technique
type: Class
subclass of: ATTACK Enterprise Technique
subclass of: Offensive Technique
subclass of: Restriction
  on property: enables
  some values from: Resource Development
type: NamedIndividual
enables: Resource Development

Resource Fork
type: Class
subclass of: File Section
type: NamedIndividual
definition: The resource fork is a fork or section of a file on Apple's classic Mac OS operating system, which was also carried over to the modern macOS for compatibility, used to store structured data along with the unstructured data stored within the data fork.

Restoration Event
type: Class
subclass of: Security Event
type: NamedIndividual
related: Restore
definition: An event representing actions to return a compromised system or resource to a trusted operational state, such as through backup restoration, system reinstallation, or repair.

Restore
type: Class
subclass of: Defensive Tactic
type: NamedIndividual
type: Defensive Tactic
display-order: 5
display-priority: 0
definition: The restore tactic is used to return the system to a better state.

Restore Access
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Restore
type: NamedIndividual
enables: Restore
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
d3fend-id: D3-RA
definition: Restoring an entity's access to resources.

Restore Configuration
type: Class
subclass of: Restore Object
subclass of: Restriction
  on property: restores
  some values from: Configuration Resource
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Configuration Resource
d3fend-id: D3-RC
definition: Restoring an software configuration.

Restore Database
type: Class
subclass of: Restore Object
subclass of: Restriction
  on property: restores
  some values from: Database
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Database
d3fend-id: D3-RD
definition: Restoring the data in a database.

Restore Disk Image
type: Class
subclass of: Restore Object
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
d3fend-id: D3-RDI
definition: Restoring a previously captured disk image a hard drive.

Restore Email
type: Class
subclass of: Restore File
subclass of: Restriction
  on property: restores
  some values from: Email
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Email
d3fend-id: D3-RE
definition: Restoring an email for an entity to access.

Restore File
type: Class
subclass of: Restore Object
subclass of: Restriction
  on property: restores
  some values from: File
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: File
d3fend-id: D3-RF
definition: Restoring a file for an entity to access.

Restore Network Access
type: Class
subclass of: Restore Access
subclass of: Restriction
  on property: restores
  some values from: Host
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Host
d3fend-id: D3-RNA
definition: Restoring a entity's access to a computer network.

Restore Object
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Restore
type: NamedIndividual
enables: Restore
d3fend-id: D3-RO
definition: Restoring an object for an entity to access. This is the broadest class for object restoral.

Restore Software
type: Class
subclass of: Restore Object
subclass of: Restriction
  on property: restores
  some values from: Software
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Software
d3fend-id: D3-RS
definition: Restoring software to a host.

Restore User Account Access
type: Class
subclass of: Restore Access
subclass of: Restriction
  on property: restores
  some values from: UserAccount
type: NamedIndividual
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: UserAccount
d3fend-id: D3-RUAA
definition: Restoring a user account's access to resources.

Resume Process
type: Class
subclass of: System Call
subclass of: Restriction
  on property: resumes
  some values from: Process
type: NamedIndividual
resumes: Process

Resume Thread
type: Class
subclass of: System Call
subclass of: Restriction
  on property: resumes
  some values from: Thread
type: NamedIndividual
resumes: Thread

Reverse Proxy Server
type: Class
subclass of: Proxy Server
definition: In computer networks, a reverse proxy is a type of proxy server that retrieves resources on behalf of a client from one or more servers. These resources are then returned to the client, appearing as if they originated from the proxy server itself. Unlike a forward proxy, which is an intermediary for its associated clients to contact any server, a reverse proxy is an intermediary for its associated servers to be contacted by any client. In other words, a proxy acts on behalf of the client(s), while a reverse proxy acts on behalf of the server(s); a reverse proxy is usually an internal-facing proxy used as a 'front-end' to control and protect access to a server on a private network.

Reverse Resolution IP Denylisting
type: Class
subclass of: DNS Denylisting
subclass of: Restriction
  on property: blocks
  some values from: Outbound Internet DNS Lookup Traffic
type: NamedIndividual
blocks: Outbound Internet DNS Lookup Traffic
kb-reference: Reference-UseDNSPolicyForApplyingFiltersOnDNSQueries
d3fend-id: D3-RRID
kb-article: ## How it works This technique prevents a client from learning domains deemed to be potentially malicious, which would have been delivered via reverse resolution responses over the DNS protocol. Queries for reverse resolution requests (that is, requests where IP(s) are sent and a domain is returned) are collected, and the IP address(es) included in the query are examined. If the IP address(es) are in a range included in the blacklist, then the query is dropped. ## Considerations - The blacklist will have to be maintained and will need to be kept up to date with identified maintenance cycles to ensure lists are not stale. - DNS query traffic can be transmitted over many different protocols, which presents a challenge to implementing methods to extract all DNS query IP address value(s). - DNS has historically used UDP port 53, with TCP port 53 instead used for responses over 512 bytes or after a lack of response over UDP. - Usage of new protocols to provide confidentiality for DNS traffic, such as DoH (DNS over HTTPS) and DoT (DNS over TLS), complicates collection of the IP address(es) in DNS queries. These protocols have often been enabled in browser settings transparently after a browser update, with DNS queries proxied over one of these cryptographic protocols through a specified host.
definition: Blocking a reverse lookup based on the query's IP address value.
synonym: Reverse Resolution IP Blacklisting

Revoke Privileges from Group Event
type: Class
subclass of: Group Management Event
subclass of: Permission Revoking Event
subclass of: Restriction
  on property: preceded-by
  some values from: Assign Privileges to Group Event
definition: An event where specific privileges or rights are removed from a group, restricting its members from performing actions or accessing resources previously allowed by those privileges.

Router
type: Class
subclass of: Computer Network Node
definition: A router is a networking device that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet. Data sent through the internet, such as a web page or email, is in the form of data packets. A packet is typically forwarded from one router to another router through the networks that constitute an internetwork (e.g. the Internet) until it reaches its destination node.

Routing Access Mediation
type: Class
subclass of: Network Access Mediation
subclass of: Restriction
  on property: isolates
  some values from: Network
type: NamedIndividual
isolates: Network
kb-reference: Reference-WhatIsNetworkAccessControl
d3fend-id: D3-RAM
definition: Routing access mediation is a network security approach that manages and controls access at the network layer using VPNs, tunneling protocols, firewall rules, and traffic inspection to ensure secure and efficient data routing.
kb-article: ## How it works Routing Access Mediation is a network security strategy focused on managing and controlling access at the network layer. It includes the use of VPNs for secure remote access, tunneling protocols for encapsulating data, firewall rules for filtering traffic, and advanced inspection techniques like Cisco's Context-Based Access Control (CBAC) to monitor and regulate data flow. This approach ensures secure and efficient routing of data across networks, protecting against unauthorized access and enhancing overall network security.

Runtime Variable
type: Class
subclass of: Digital Information Bearer
definition: A runtime variable is an abstract storage location paired with an associated symbolic name, which contains some known or unknown quantity of data or object referred to as a value, which can change during the execution of a computer program.

SARSA
type: Class
subclass of: Model-free Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-SAR
kb-article: ## References State-action-reward-state-action. Wikipedia. [Link](https://en.wikipedia.org/wiki/State%E2%80%93action%E2%80%93reward%E2%80%93state%E2%80%93action).
definition: State-action-reward-state-action (SARSA) is an algorithm for learning a Markov decision process policy, used in the reinforcement learning area of machine learning.

SMB Event
type: Class
subclass of: Application Layer Event
subclass of: TCP Event
subclass of: Restriction
  on property: has-participant
  some values from: File Transfer Network Traffic
definition: An event involving the Server Message Block (SMB) protocol, a network file sharing protocol that allows client-server communication for accessing files, printers, and other shared network resources. SMB supports both transactional file operations and communication over reliable transport layers.

SMB File Create Event
type: Class
subclass of: SMB Event
definition: An event where a file is created if it does not already exist, failing if the file is already present. This operation strictly enforces new file creation.

SMB File Open Event
type: Class
subclass of: SMB Event
subclass of: Restriction
  on property: preceded-by
  some values from: SMB File Create Event
definition: An event where a file is opened if it exists, failing otherwise. This operation is used to access or query the existing file.

SMB File Open If Event
type: Class
subclass of: SMB Event
definition: An event where a file is opened if it exists, or created if it does not. This operation merges file creation and access behavior.

SMB File Overwrite Event
type: Class
subclass of: SMB Event
subclass of: Restriction
  on property: preceded-by
  some values from: SMB File Create Event
definition: An event where a file is opened and truncated if it exists, failing if the file does not already exist. This operation is destructive and focuses on replacing the file's contents.

SMB File Overwrite If Event
type: Class
subclass of: SMB Event
definition: An event where a file is opened and truncated if it exists, or created otherwise. This operation combines destructive overwrite and creation behaviors.

SMB File Supersede Event
type: Class
subclass of: SMB Event
definition: An event where a file is overwritten if it exists or created if it does not. This operation combines file creation and modification semantics.

SPARTA Thing
type: Class
subclass of: External Threat Model Thing

SSH Connection Close Event
type: Class
subclass of: Network Connection Close Event
subclass of: SSH Event
subclass of: Restriction
  on property: preceded-by
  some values from: SSH Connection Open Event
definition: An event indicating the termination of an SSH connection, signaling the end of a secure session.

SSH Connection Fail Event
type: Class
subclass of: Network Connection Fail Event
subclass of: SSH Event
definition: An event indicating a failure to establish an SSH connection, often due to issues such as authentication errors, network timeouts, or server unavailability.

SSH Connection Open Event
type: Class
subclass of: Network Connection Open Event
subclass of: SSH Event
definition: An event indicating the successful establishment of an SSH connection between a client and a server, marking the initiation of a secure session.

SSH Connection Refuse Event
type: Class
subclass of: Network Connection Refuse Event
subclass of: SSH Event
definition: An event indicating that an SSH connection attempt was refused, typically due to server-side restrictions or closed ports.

SSH Connection Reset Event
type: Class
subclass of: Network Connection Reset Event
subclass of: SSH Event
subclass of: Restriction
  on property: preceded-by
  some values from: SSH Connection Open Event
definition: An event indicating the abrupt termination of an SSH connection due to protocol errors, network disruptions, or administrative actions.

SSH Event
type: Class
subclass of: Application Layer Event
subclass of: TCP Event
subclass of: Restriction
  on property: has-participant
  some values from: SSH Session
definition: An event involving the Secure Shell (SSH) protocol, a cryptographic network protocol designed to provide secure remote login, command execution, and data transfer. SSH facilitates encrypted communication between clients and servers, ensuring confidentiality, integrity, and authenticity.

SSH Listen Event
type: Class
subclass of: Network Connection Listen Event
subclass of: SSH Event
definition: An event indicating that an SSH server has started listening for incoming connection requests, enabling potential clients to initiate secure sessions.

SSH Session
type: Class
subclass of: Remote Session
type: NamedIndividual
definition: A Secure Shell Protocol (SSH) session is a session over a secure channel established using SSH to connect a client to a server and establish the remote session.

Save Registers
type: Class
subclass of: System Call
subclass of: Restriction
  on property: copies
  some values from: Processor Register
type: NamedIndividual
copies: Processor Register

Saved Instruction Pointer
type: Class
subclass of: Pointer
subclass of: Stack Component
definition: A saved instruction pointer points to the instruction that generated an exception (trap or fault).

Scheduled Job
type: Class
subclass of: Operating System Process
subclass of: Restriction
  on property: contained-by
  some values from: Job Schedule
subclass of: Restriction
  on property: created-by
  some values from: Job Scheduler Software
subclass of: Restriction
  on property: modified-by
  some values from: Job Scheduler Software
type: NamedIndividual
contained-by: Job Schedule
created-by: Job Scheduler Software
modified-by: Job Scheduler Software
definition: A task scheduler process is an operating system process that executes scheduled tasks (time-scheduling in the sense of wall clock time; not operating system scheduling of processes for multitasking).
synonym: Scheduled Task
synonym: Task Scheduler Process

Scheduled Job Analysis
type: Class
subclass of: Operating System Monitoring
subclass of: Restriction
  on property: analyzes
  some values from: Job Schedule
type: NamedIndividual
analyzes: Job Schedule
kb-reference: Reference-ExecutionWithAT MITRE
kb-reference: Reference-ExecutionWithSchtasks MITRE
kb-reference: Reference-PreventingExecutionOfTaskScheduledMalware McAfeeLLC
d3fend-id: D3-SJA
definition: Analysis of source files, processes, destination files, or destination servers associated with a scheduled job to detect unauthorized use of job scheduling.
synonym: Scheduled Job Execution
kb-article: ## How it works Scheduled job execution can be utilized by adversaries for the purpose of persistence, conducting remote execution, or gaining privileges. Details of a scheduled job such as associated source files, processes, destination files, or destination servers are first identified and analyzed and then compared against an anti-malware signature database, whitelist, or reputation server. For example, a file associated with a scheduled job to be executed at a specified time or a remote server that is accessed as part of a scheduled task is compared against an anti-malware signature database, whitelist, or reputation server, and if a match is found, execution is denied and an alert is generated. In addition to traditional scheduled jobs, triggers can be set to execute a specific command after detecting a specific event in the system, such as with WMI Event Subscriptions in Windows. ## Considerations Jobs can be scheduled in many different and sometimes creative ways through operating system capabilities.

Scheduled Job Creation Event
type: Class
subclass of: Scheduled Job Event
definition: An event representing the addition of a new task to the system's scheduler, defining its execution criteria and associated actions.

Scheduled Job Deletion Event
type: Class
subclass of: Scheduled Job Event
subclass of: Restriction
  on property: preceded-by
  some values from: Scheduled Job Creation Event
definition: An event marking the removal of a scheduled task from the system, terminating its execution schedule.

Scheduled Job Disable Event
type: Class
subclass of: Scheduled Job Event
subclass of: Restriction
  on property: preceded-by
  some values from: Scheduled Job Enable Event
definition: An event where a scheduled task is deactivated, preventing further execution until re-enabled.

Scheduled Job Enable Event
type: Class
subclass of: Scheduled Job Event
subclass of: Restriction
  on property: preceded-by
  some values from: Scheduled Job Creation Event
definition: An event where a scheduled task is activated, allowing it to execute according to its defined parameters.

Scheduled Job Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: has-participant
  some values from: Scheduled Job
definition: An event capturing the lifecycle or management of scheduled tasks within a system, including creation, modification, execution, or removal.

Scheduled Job Start Event
type: Class
subclass of: Scheduled Job Event
subclass of: Restriction
  on property: preceded-by
  some values from: Scheduled Job Creation Event
definition: An event indicating the execution of a scheduled task, triggered either automatically by the scheduler or manually by a user.

Scheduled Job Update Event
type: Class
subclass of: Scheduled Job Event
subclass of: Restriction
  on property: preceded-by
  some values from: Scheduled Job Creation Event
definition: An event where an existing scheduled task is updated, altering parameters such as timing, conditions, or actions.

Scheduling
type: Class
subclass of: Planning

Script Application Process
type: Class
subclass of: Application Process
subclass of: Restriction
  on property: interprets
  some values from: Executable Script
type: NamedIndividual
interprets: Executable Script
alternative label: Script Process
definition: A script application process is an application process interpreting an executable script.

Script Execution Analysis
type: Class
subclass of: Process Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Script Application Process
type: NamedIndividual
analyzes: Script Application Process
kb-reference: Reference-DetectingScript-basedMalware CrowdstrikeInc
d3fend-id: D3-SEA
kb-article: ## How it works Software installed on the host system hooks into a scripting engine to intercept commands before they are executed and block commands if they are determined to be harmful. Pattern matching is used to identify unauthorized commands or in the case of script files, a hash of the file is compared against hashes of known unauthorized script files. ## Considerations List of known unauthorized script files or regular expression patterns must be kept up to date to ensure detection of new threats.
definition: Analyzing the execution of a script to detect unauthorized user activity.

Second-stage Boot Loader
type: Class
subclass of: Boot Loader
definition: An optional, often feature rich, second stage set of routines run in order to load the operating system.

Secondary Storage
type: Class
subclass of: Hardware Device
subclass of: Storage
type: NamedIndividual
definition: Secondary memory (storage, hard disk) is the computer component holding information that does not need to be accessed quickly and that needs to be retained long-term.

Security Event
type: Class
subclass of: Digital Event
subclass of: Restriction
  on property: caused-by
  some values from: Defensive Action
definition: An event describing occurrences related to cybersecurity, including detection, remediation, or enforcement actions. Security events provide critical insights into the state, behavior, and resilience of digital systems.

Security Token
type: Class
subclass of: Hardware Device
subclass of: Restriction
  on property: contains
  some values from: Access Token
type: NamedIndividual
contains: Access Token
definition: Security tokens are peripheral devices used to prove one's identity electronically (as in the case of a customer trying to access their bank account). The token is used in addition to or in place of a password to prove that the customer is who they claim to be. The token acts like an electronic key to access something.

Segment Address Offset Randomization
type: Class
subclass of: Application Hardening
subclass of: Restriction
  on property: obfuscates
  some values from: Process Segment
type: NamedIndividual
kb-reference: Reference-DYNAMICBASE UseAddressSpaceLayoutRandomization MicrosoftDocs
kb-reference: Reference-HowASLRProtectsLinuxSystemsFromBufferOverflowAttacks NetworkWorld
obfuscates: Process Segment
d3fend-id: D3-SAOR
kb-article: ## How it works Many application exploits rely on an attacker specifying a location in memory, which points to data or code used by the attacker. If the addresses are changed each time the program is run, then it becomes more difficult for the attacker to determine the location that will contain the code they wish to run. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing." Just as not all code is built for participation in ASLR, not all modules can be rebased; instead, modules must indicate whether they implement support for rebasing. Such information to relocate the executable is typically stored in the ".reloc" segment -- each of the addresses pointed to in this segment has its address increased by the amount of the offset. (An alternative method for relocation would be to add an amount to a global variable each time -- leading to less overhead in the module load, but more for each access. Still another implementation could instead contain code to deference each changeable memory location on the fly, so that each of the references do not need to be updated. ## Considerations As the offset for each segment is constant, it is possible to guess at the value of the address given the address of another variable. Alternatively, memory pointers may be kept around, which contain the address of another variable. Another bypass technique is known as an "egg hunt," whereby the attacker searches for a rather unique piece of the data or code in memory to determine its likely address. The program needs to store these addresses for the functions somewhere. In Linux, the PLT contains a "trampoline" to these addresses. If an attacker desires to jump to the start of an existing function, they can jump directly to the trampoline anyway, and may have the opportunity to provide their own stack frame to the function with a write to the stack. If they overwrite a saved stack pointer which is loaded …
synonym: Address Space Layout Randomization
definition: Randomizing the base (start) address of one or more segments of memory during the initialization of a process.
synonym: ASLR

Self-organizing Map
type: Class
subclass of: ANN-based Clustering
type: NamedIndividual
d3fend-id: D3A-SOM
definition: A Self-Organizing Map (SOM) is a unsupervised learning model in Artificial Neural Network where the feature maps are the generated two-dimensional discretized form of an input space during the model training (based on competitive learning)
kb-article: ## References GeeksforGeeks. (n.d.). ANN - Self Organizing Neural Network (SONN). [Link](https://www.geeksforgeeks.org/ann-self-organizing-neural-network-sonn/)

Semi-Supervised Learning
type: Class
subclass of: Machine Learning
type: NamedIndividual
d3fend-id: D3A-SSL
kb-article: ## References Semi-Supervised Learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Semi-Supervised_Learning).
definition: Semi-supervised learning is a branch of machine learning that combines a small amount of labeled data with a large amount of unlabeled data during training.

Semi-supervised Boosting
type: Class
subclass of: Semi-supervised Wrapper Method
type: NamedIndividual
d3fend-id: D3A-SSB
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)
definition: Boosting methods can be readily extended to the semi-supervised setting, by introducing pseudo-labeled data after each learning step; which gives rise to the idea of semi-supervised boosting methods. The pseudo-labeling approach of self- training and co-training can be easily extended to boosting methods. Several boosting methods such as SSMBoost, ASSEMBLE, SemiBoost, RegBoost, etc can be found which can be applied for utilizing unlabeled datasets for supervised classifiers.

Semi-supervised Cluster-then-label
type: Class
subclass of: UnsupervisedPreprocessing
type: NamedIndividual
d3fend-id: D3A-SSCTL
definition: Pre-training methods are aimed to guide the parameters of a network towards interesting regions in model space using unlabeled data, before fine-tuning the parameters with the labeled data.
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)

Semi-supervised Co-training
type: Class
subclass of: Semi-supervised Wrapper Method
type: NamedIndividual
d3fend-id: D3A-SSCT
definition: Multi-view co-training involves training the classifiers in completely different views of training data. On the other hand, single-view co-training methods are generally applied as ensemble methods.
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)

Semi-supervised Feature Extraction
type: Class
subclass of: UnsupervisedPreprocessing
type: NamedIndividual
d3fend-id: D3A-SSFE
definition: Feature extraction refers to reducing the number of dimensions in a data point so that it is computationally feasible and effective to learn a model.
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)

Semi-supervised Generative Model Learning
type: Class
subclass of: Intrinsically Semi-supervised Learning
type: NamedIndividual
d3fend-id: D3A-SSGML
definition: A Semi Supervised Machine Learning model which assume that the distributions take some particular form p(x|y,theta) parameterized by the vector. If these assumptions are incorrect, the unlabeled data may actually decrease the accuracy of the solution relative to what would have been obtained from labeled data alone. However, if the assumptions are correct, then the unlabeled data necessarily improves performance.
kb-article: ## References Weak supervision. Wikipedia. [Link](https://en.wikipedia.org/wiki/Weak_supervision#Generative_models).

Semi-supervised Inductive Learning
type: Class
subclass of: Semi-Supervised Learning
type: NamedIndividual
d3fend-id: D3A-SSIL
definition: The goal of inductive learning is to infer the correct mapping from X to Y
kb-article: ## References Semi-Supervised Learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Semi-Supervised_Learning#Semi-supervised_learning). Zhou, D., & Li, M. (2005). Semi-supervised learning by higher order regularization. In Proceedings of the 43rd Annual Meeting of the Association for Computational Linguistics (ACL) (pp. 1-9). [Link](https://www.cs.sfu.ca/~anoop/papers/pdf/semisup_naacl.pdf).

Semi-supervised Manifold Learning
type: Class
subclass of: Intrinsically Semi-supervised Learning
type: NamedIndividual
d3fend-id: D3A-SSML
kb-article: ## References Weak supervision. Wikipedia. [Link](https://en.wikipedia.org/wiki/Weak_supervision#Generative_models).
definition: A version of Semi-Supervised Learning that applies the Manifold assumption that the data like approximately on a manifold of much lower dimension than the input space.

Semi-supervised Pre-training
type: Class
subclass of: UnsupervisedPreprocessing
type: NamedIndividual
d3fend-id: D3A-SSPT
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)
definition: Pre-training methods are aimed to guide the parameters of a network towards interesting regions in model space using unlabeled data, before fine-tuning the parameters with the labeled data

Semi-supervised Self-training
type: Class
subclass of: Semi-supervised Wrapper Method
type: NamedIndividual
d3fend-id: D3A-SSST
definition: Self-training is the procedure in which a supervised method for classification or regression is modified it to work in a semi-supervised manner, taking advantage of labeled and unlabeled data
kb-article: ## References AltexSoft. (n.d.). Semi-Supervised Learning: A Technical Guide with Python Examples. [Link](https://www.altexsoft.com/blog/semi-supervised-learning/#:~:text=One%20of%20the%20simplest%20examples,of%20labeled%20and%20unlabeled%20data.)

Semi-supervised Transductive Learning
type: Class
subclass of: Semi-Supervised Learning
type: NamedIndividual
d3fend-id: D3A-SSTL
definition: The goal of transductive learning is to infer the correct labels for the given unlabeled data x_{l+1},... ,x_{l+u} only
kb-article: ## References Semi-Supervised Learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Semi-Supervised_Learning#Semi-supervised_learning). Zhou, D., & Li, M. (2005). Semi-supervised learning by higher order regularization. In Proceedings of the 43rd Annual Meeting of the Association for Computational Linguistics (ACL) (pp. 1-9). [Link](https://www.cs.sfu.ca/~anoop/papers/pdf/semisup_naacl.pdf).

Semi-supervised Wrapper Method
type: Class
subclass of: Semi-Supervised Learning
type: NamedIndividual
d3fend-id: D3A-SSWM
definition: The principle behind wrapper methods is that we train a model with labeled data and then generate pseudo-labels for the unlabeled data using the trained model iteratively.
kb-article: ## References Jashish, M. (n.d.). Beginner's Guide to Semi-Supervised Learning. Jashish Blog. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/).

Sender MTA Reputation Analysis
type: Class
subclass of: Message Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Email
type: NamedIndividual
analyzes: Email
kb-reference: Reference-SystemsAndMethodsForDetectingAnd orHandlingTargetedAttacksInTheEmailChannel GraphusInc
d3fend-id: D3-SMRA
definition: Characterizing the reputation of mail transfer agents (MTA) to determine the security risk in emails.
kb-article: ## How it works The sender message transfer agent (MTA) trust rating can be considered an indicator of the level of security risk and/or a trust level associated with sender MTAs in an email header. The features considered in determining the trust rating may include: * Length of time MTA has interacted with the enterprise * Number of sender domains sending emails from the MTA * Number of recipients in the enterprise the MTA sends emails to * Number of emails received from this MTA * Number of email replies received from this MTA For example, higher values for the length of time an MTA has interacted with the enterprise, or number of emails received from an MTA can result in a higher trust rating. The trust rating categorizes the sender MTA as unrated, neutral, trusted, suspicious, or malicious. ## Considerations Legitimate emails from a sender MTA may receive a lower trust rating over time if the sender's domain gets spoofed and is used to send unauthorized emails.

Sender Reputation Analysis
type: Class
subclass of: Message Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Email
type: NamedIndividual
analyzes: Email
kb-reference: Reference-SystemsAndMethodsForDetectingAnd orHandlingTargetedAttacksInTheEmailChannel GraphusInc
d3fend-id: D3-SRA
definition: Ascertaining sender reputation based on information associated with a message (e.g. email/instant messaging).
kb-article: ## How it works Sender trust rating can be considered an indicator of the level of security risk and/or a trust level associated with a sender. The features considered in determining the trust rating include: * Length of time sender has sent emails to the enterprise * Number of recipients in the enterprise the sender interacts with * Sender vs. enterprise originated message ratio * Sender messages opened vs. not-opened ratio * Number of emails received from this sender * Number of emails replied to this sender * Number of emails from this sender not opened * Number of emails from this sender not opened that contain an attachment * Number of emails from this sender not opened that contain a URL * Number of emails sent to this sender * Number of email replies received from this sender. Higher values for the number of recipients the sender has interacted with or the number of emails received from the sender, for example, results in a higher trust rating. The trust rating can categorize the sender as unrated, neutral, trusted, suspicious, or malicious. ## Considerations Legitimate emails from a sender may receive a lower trust rating over time if the sender's domain gets spoofed and is used to send unauthorized emails.

Sensor
type: Class
subclass of: D3FEND Core
subclass of: Digital Information Bearer
definition: In the broadest definition, a sensor is a device, module, machine, or subsystem that detects events or changes in its environment and sends the information to other electronics, frequently a computer.

SeqGAN
type: Class
subclass of: Generative Adversarial Network
type: NamedIndividual
d3fend-id: D3A-SEQ
synonym: Sequence GAN
kb-article: ## References Yu, L., Zhang, W., Wang, J., & Yu, Y. (2017). SeqGAN: Sequence Generative Adversarial Nets with Policy Gradient. ArXiv preprint ArXiv:1609.05473. [Link](https://arxiv.org/abs/1609.05473)
definition: Sequence Generation Framework (SeqGAN) models the data generator as a stochastic policy in reinforcement learning (RL), SeqGAN bypasses the generator differentiation problem by directly performing gradient policy update.

Serialization Function
type: Class
subclass of: Subroutine
definition: A function which has an operation that serializes data.

Server
type: Class
subclass of: Host
subclass of: Restriction
  on property: manages
  some values from: Service Application Process
subclass of: Restriction
  on property: runs
  some values from: Service Application
type: NamedIndividual
manages: Service Application Process
runs: Service Application
definition: In computing, a server is a piece of computer hardware or software (computer program) that provides functionality for other programs or devices, called "clients". This architecture is called the client-server model. Servers can provide various functionalities, often called "services", such as sharing data or resources among multiple clients, or performing computation for a client. A single server can serve multiple clients, and a single client can use multiple servers. A client process may run on the same device or may connect over a network to a server on a different device. Typical servers are database servers, file servers, mail servers, print servers, web servers, game servers, and application servers.

Service Account
type: Class
subclass of: UserAccount
definition: A service account is a type of account used by an application or service to interact with the operating system.
synonym: System Account

Service Application
type: Class
subclass of: Application
type: NamedIndividual
definition: An application that provides a set of software functionalities so that multiple clients who can reuse the functionality, provided they are authorized for use of the service.

Service Application Process
type: Class
subclass of: Application Process
type: NamedIndividual
definition: A Service Application Process performs specific tasks or provides functionality to support other processes, applications, or users.

Service Binary Verification
type: Class
subclass of: System File Analysis
subclass of: Restriction
  on property: verifies
  some values from: Service Application
type: NamedIndividual
kb-reference: Reference-ServiceBinaryModifications MITRE
verifies: Service Application
d3fend-id: D3-SBV
definition: Analyzing changes in service binary files by comparing to a source of truth.
kb-article: ## How it works System service applications may originate from the operating system installation or third-party applications installed with administrative privileges. These services have an entry point of some executable file-- a binary or a script. Attackers sometimes modify these executables to launch their own code. Analyzing changes in these files may uncover unauthorized activity. ## Considerations * These files change for legitimate reasons when the system or software updates. * The source of truth must not be corrupted in order for this method to work.

Service Deletion Event
type: Class
subclass of: Application Deletion Event
subclass of: Service Event
subclass of: Restriction
  on property: preceded-by
  some values from: Service Installation Event
definition: An event capturing the uninstallation or deregistration of a service application, ensuring it is no longer operational or available to clients.

Service Dependency
type: Class
subclass of: Dependency
type: NamedIndividual
definition: A service dependency indicates a service has an activity, agent, or another service which relies on it in order to be functional.

Service Dependency Mapping
type: Class
subclass of: System Mapping
subclass of: Restriction
  on property: maps
  some values from: Service Dependency
type: NamedIndividual
kb-reference: Reference-CatiaUAFPlugin
kb-reference: Reference-UnifiedArchitectureFrameworkUAF
maps: Service Dependency
d3fend-id: D3-SVCDM
synonym: Distributed Tracing
definition: Service dependency mapping determines the services on which each given service relies.
kb-article: ## How it works The organization collects and models architectural information about the services and consumers of services and maps the dependencies between the services. ## Considerations * Architectural design artifacts and SMEs may need to be consulted to determine if dependencies are intended or otherwise essential. * Service dependencies for critical systems--those supporting critical organizational activities--should be prioritized for supply chain risk analysis. * Service dependencies in cloud or microservice architectures may be discovered using distributed tracing capabilities

Service Disable Event
type: Class
subclass of: Application Disable Event
subclass of: Service Event
subclass of: Restriction
  on property: preceded-by
  some values from: Service Enable Event
definition: An event capturing the deactivation of a service application, preventing it from being started or accessed until re-enabled.

Service Enable Event
type: Class
subclass of: Application Enable Event
subclass of: Service Event
subclass of: Restriction
  on property: preceded-by
  some values from: Service Installation Event
definition: An event representing the activation of a service application, allowing it to start and provide its background or networked functionality.

Service Event
type: Class
subclass of: Application Event
subclass of: Restriction
  on property: has-participant
  some values from: Service Application
definition: An event capturing the operation, configuration, or lifecycle of a service application. Services are specialized applications designed to provide reusable functionality to clients, systems, or other applications, often operating in the background or across networks.

Service Installation Event
type: Class
subclass of: Application Installation Event
subclass of: Service Event
definition: An event representing the installation or registration of a service application within the system, enabling it to provide background or reusable functionality.

Service Provider
type: Class
subclass of: Provider
definition: A service provider offers delivery of intangible outputs such as expertise, support, or access to resources to individuals, organizations, or other entities.

Service Restart Event
type: Class
subclass of: Application Restart Event
subclass of: Service Event
subclass of: Restriction
  on property: preceded-by
  some values from: Service Stop Event
subclass of: Restriction
  on property: precedes
  some values from: Service Start Event
definition: An event describing the sequential stopping and starting of a service application to refresh its state, apply updates, or resolve operational issues.

Service Start Event
type: Class
subclass of: Application Start Event
subclass of: Service Event
subclass of: Restriction
  on property: preceded-by
  some values from: Service Installation Event
definition: An event representing the initiation of a service application, transitioning it from an inactive state to an active state, enabling its background or networked operations.

Service Stop Event
type: Class
subclass of: Application Stop Event
subclass of: Service Event
subclass of: Restriction
  on property: preceded-by
  some values from: Service Start Event
definition: An event capturing the cessation of a service application’s operations, transitioning it to an inactive state while ceasing its functionality to clients or dependent systems.

Service Update Event
type: Class
subclass of: Application Update Event
subclass of: Service Event
subclass of: Restriction
  on property: preceded-by
  some values from: Service Installation Event
definition: An event describing changes made to a service application, such as updates, reconfigurations, or patch installations, ensuring its continued availability and functionality.

Session
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: In computer science, in particular networking, a session is a semi-permanent interactive information interchange, also known as a dialogue, a conversation or a meeting, between two or more communicating devices, or between a computer and user (see Login session). A session is set up or established at a certain point in time, and then torn down at some later point. An established communication session may involve more than one message in each direction. A session is typically, but not always, stateful, meaning that at least one of the communicating parts needs to save information about the session history in order to be able to communicate, as opposed to stateless communication, where the communication consists of independent requests with responses.

Session Cookie
type: Class
subclass of: Credential
type: NamedIndividual
alternative label: Web Session Cookie
alternative label: Transient Cookie
alternative label: In-memory Cookie
alternative label: Non-persistent Cookie
definition: A session cookie, also known as an in-memory cookie, transient cookie or non-persistent cookie, exists only in temporary memory while the user navigates the website. Web browsers normally delete session cookies when the user closes the browser. Unlike other cookies, session cookies do not have an expiration date assigned to them, which is how the browser knows to treat them as session cookies.

Session Duration Analysis
type: Class
subclass of: UserBehaviorAnalysis
subclass of: Restriction
  on property: analyzes
  some values from: Authentication
subclass of: Restriction
  on property: analyzes
  some values from: Authorization
type: NamedIndividual
analyzes: Authentication
analyzes: Authorization
kb-reference: Reference-MethodAndApparatusForNetworkFraudDetectionAndRemediationThroughAnalytics IdaptiveLLC
kb-reference: Reference-System,Method,AndComputerProgramProductForDetectingAndAssessingSecurityRisksInANetwork ExabeamInc
d3fend-id: D3-SDA
kb-article: ## How it works Detecting unauthorized user sessions by comparing the duration of a user logon session with a baseline behavior model. The behavior model comprises historical user session duration times. Abnormalities between session duration and the behavior model may indicate suspicious activity. ## Considerations * Potential for false positives from anomalies that are not associated with malicious activity. * Attackers may not differentiate their session duration enough to trigger an alert.
definition: Analyzing the duration of user sessions in order to detect unauthorized activity.

Session Termination
type: Class
subclass of: Process Eviction
subclass of: Restriction
  on property: deletes
  some values from: Session
type: NamedIndividual
deletes: Session
kb-reference: Reference-NIST-Special-Publication-800-53A-Revision-5
d3fend-id: D3-ST
definition: Forcefully end all active sessions associated with compromised accounts or devices.
kb-article: Defined in NIST 800-53 as AC-12.

Session Token
type: Class
subclass of: Access Token
type: NamedIndividual
synonym: Session ID
kb-article: ## How it works Session identifiers become necessary in cases where the communications infrastructure uses a stateless protocol such as HTTP. For example, a buyer who visits a seller's website wants to collect a number of articles in a virtual shopping cart and then finalize the shopping by going to the site's checkout page. This typically involves an ongoing communication where several webpages are requested by the client and sent back to them by the server. In such a situation, it is vital to keep track of the current state of the shopper's cart, and a session ID is one way to achieve that goal.
definition: In computer science, a session identifier, session ID or session token is a piece of data that is used in network communications (often over HTTPS) to identify a session, a series of related message exchanges.
synonym: Session Token
synonym: Session Identifier

Set Registers
type: Class
subclass of: System Call
subclass of: Restriction
  on property: modifies
  some values from: Processor Register
type: NamedIndividual
modifies: Processor Register

Set System Config Value
type: Class
subclass of: System Config System Call
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record

Set Thread Context
type: Class
subclass of: System Call
subclass of: Restriction
  on property: modifies
  some values from: Thread
type: NamedIndividual
modifies: Thread

Shadow Stack
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: copy-of
  some values from: Call Stack
type: NamedIndividual
copy-of: Call Stack
definition: A shadow stack is a mechanism for protecting a procedure's stored return address, such as from a stack buffer overflow. The shadow stack itself is a second, separate stack that "shadows" the program call stack. In the function prologue, a function stores its return address to both the call stack and the shadow stack. In the function epilogue, a function loads the return address from both the call stack and the shadow stack, and then compares them. If the two records of the return address differ, then an attack is detected.

Shadow Stack Comparisons
type: Class
subclass of: Process Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Stack Frame
type: NamedIndividual
analyzes: Stack Frame
kb-reference: Reference-ThreatDetectionForReturnOrientedProgramming CrowdstrikeInc
d3fend-id: D3-SSC
kb-article: ## How it works This technique compares the call stack stored in system memory with the shadow call stack maintained in the cache memory of the processor. Mismatches between the two are compared since a return oriented programming attack may only be able to control or spoof the call stack and not the shadow call stack. Mismatches are counted and if the number of mismatches exceeds a certain threshold it is an indication of unauthorized activity and a security response action is performed. ## Considerations If the threshold for detecting a stack anomaly is low, it may not detect a return-oriented attack with just one gadget, such as a return-to-libc or return-to-plt attack. Additionally, this technique may not detect JOP (Jump-oriented programming), as the return instruction is not executed.
definition: Comparing a call stack in system memory with a shadow call stack maintained by the processor to determine unauthorized shellcode activity.

Shared Computer
type: Class
subclass of: Client Computer
definition: A computer whose resources are intended to be shared widely.

Shared Library File
type: Class
subclass of: Object File
type: NamedIndividual
definition: A shared library file is a file that is intended to be shared by executable files and further shared library (object) files. Modules used by a program are loaded from individual shared objects into memory at load time or runtime, rather than being copied by a linker when it creates a single monolithic executable file for the program
alternative label: Shared Library
alternative label: Shared Object

Shared Resource Access Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: accesses
  some values from: Resource
type: NamedIndividual
accesses: Resource
definition: A function which access a shared resource.

Shim
type: Class
subclass of: Software
type: NamedIndividual
definition: In computer programming, a shim is a small library that transparently intercepts API calls and changes the arguments passed, handles the operation itself, or redirects the operation elsewhere. Shims can be used to support an old API in a newer environment, or a new API in an older environment. Shims can also be used for running programs on different software platforms than those for which they were developed.

Shim Database
type: Class
subclass of: Application Configuration Database
type: NamedIndividual
synonym: Microsoft Shim Database File
definition: A application configuration database that contains or points to software shims (e.g., for backward compatibility, patches, etc.)

Shortcut File
type: Class
subclass of: File
definition: A shortcut file, or shortcut, is a handle that allows the user to find a file or resource located in a different directory or folder from the place where the shortcut is located. Shortcuts, which are supported by the graphical file browsers of some operating systems, may resemble symbolic links but differ in a number of important ways. One difference is what type of software is able to follow them: - Symbolic links are automatically resolved by the file system. Any software program, upon accessing a symbolic link, will see the target instead, whether the program is aware of symbolic links or not. - Shortcuts are treated like ordinary files by the file system and by software programs that are not aware of them. Only software programs that understand shortcuts (such as the Windows shell and file browsers) treat them as references to other files. Another difference are the capabilities of the mechanism: - Microsoft Windows shortcuts normally refer to a destination by an absolute path (starting from the root directory), whereas POSIX symbolic links can refer to destinations via either an absolute or a relative path. The latter is useful if both the location and destination of the symbolic link share a common path prefix[clarification needed], but that prefix is not yet known when the symbolic link is created (e.g., in an archive file that can be unpacked anywhere). - Microsoft Windows application shortcuts contain additional metadata that can be associated with the destination, whereas POSIX symbolic links are just strings that will be interpreted as absolute or relative pathnames. - Unlike symbolic links, Windows shortcuts maintain their references to their targets even when the target is moved or renamed. Windows domain clients may subscribe to a Windows service called Distributed Link Tracking to track the changes in files and folders to which they are interested. The service maintains the integrity of shortcuts, even when files and folders are moved across the netwo…

Simulation
type: Class
subclass of: Media Generation

Singular Value Decomposition
type: Class
subclass of: Dimension Reduction
type: NamedIndividual
d3fend-id: D3A-SVD
kb-article: ## References Wikipedia. (n.d.). Singular value decomposition. [Link](https://en.wikipedia.org/wiki/Singular_value_decomposition)
definition: Singular Value Decomposition (SVD) is an algorithm that represents a matrix as a linear series of data and to find the set of factors that will best predict an outcome

Skewness
type: Class
subclass of: Distribution Properties
type: NamedIndividual
d3fend-id: D3A-SKE
definition: Skewness is a measure of the asymmetry of the probability distribution of a real-valued random variable about its mean. The standardized moment of a probability distribution function.
kb-article: ## References Wikipedia. (n.d.). Skewness. [Link](https://en.wikipedia.org/wiki/Skewness)

Slow Symbolic Link
type: Class
subclass of: Symbolic Link
subclass of: UnixLink
definition: A slow symbolic link is any symbolic link on a Unix filesystem that is not a fast symbolic link; slow symlink is thus retroactively termed from fast symlink. Slow symbolic links stored the symbolic link information as data in regular files.
alternative label: Slow Symlink

Software
type: Class
subclass of: Digital Information
subclass of: Restriction
  on property: contains
  some values from: Executable File
subclass of: Restriction
  on property: implements
  some values from: Subroutine
subclass of: Restriction
  on property: instructs
  some values from: Process
type: NamedIndividual
contains: Executable File
implements: Subroutine
instructs: Process
definition: Computer software, or simply software, is that part of a computer system that consists of encoded information or computer instructions, in contrast to the physical hardware from which the system is built.

Software Artifact Server
type: Class
subclass of: Artifact Server
definition: A software artifact server provides access to the software artifacts in a software repository. A software repository, or "repo" for short, is a storage location for software packages. Often a table of contents is stored, as well as metadata. Repositories group packages. Sometimes the grouping is for a programming language, such as CPAN for the Perl programming language, sometimes for an entire operating system, sometimes the license of the contents is the criteria. At client side, a package manager helps installing from and updating the repositories.

Software Deployment Tool
type: Class
subclass of: Service Application
type: NamedIndividual
definition: Software that coordinates the deployment process of software to systems, typically remotely.

Software Inventory
type: Class
subclass of: Asset Inventory
subclass of: Restriction
  on property: inventories
  some values from: Software
type: NamedIndividual
inventories: Software
kb-reference: Reference-Web-BasedEnterpriseManagement
kb-reference: Reference-Windows-Management-Infrastructure
kb-reference: Reference-Windows-Management-Instrumentation
d3fend-id: D3-SWI
synonym: Software Discovery
definition: Software inventorying identifies and records the software items in the organization's architecture.
synonym: Software Inventorying
kb-article: ## How it works Administrators collect information on software items in their architecture using a variety of administrative and management tools that query network nodes for information. In limited cases, where such queries are not supported or provide specific information of interest, an administrator may also collect this information through network enumeration methods to determine services responding on network nodes. ## Considerations * Scanning and probing techniques using mapping tools can result in side effects to information technology (IT) and operational technology (OT) systems. * An adversary conducting network enumeration may engage in activities that parallel normal software inventorying activities, but would require escalating to admin privileges for most of the operations requiting administrative tools. ## Examples Application-layer discovery: * Simple Network Management Protocol (SNMP) collects MIB information * Web-based Enterprise Management (WBEM) collects CIM information * Windows Management Instrumentation (WMI) * Windows Management Infrastructure (MI)

Software Library
type: Class
subclass of: Software
subclass of: Restriction
  on property: contains
  some values from: Software Library File
type: NamedIndividual
contains: Software Library File
definition: A software library is a collection of software components that are used to build a software product.

Software Library File
type: Class
subclass of: File
subclass of: Restriction
  on property: contains
  some values from: Subroutine
subclass of: Restriction
  on property: may-contain
  some values from: Executable Binary
subclass of: Restriction
  on property: may-contain
  some values from: Executable Script
type: NamedIndividual
contains: Subroutine
may-contain: Executable Binary
may-contain: Executable Script
definition: A software library is a collection of software components that are used to build a software product.

Software Package
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A Software Package is a bundled collection of files, code, and metadata that provides functionality, libraries, or applications.

Software Packaging Tool
type: Class
subclass of: Build Tool
definition: A tool that automates the process of packaging either or both binary code and source code for use on one or more target platforms.

Software Patch
type: Class
subclass of: Software
definition: A patch is a piece of software designed to update a computer program or its supporting data, to fix or improve it. This includes fixing security vulnerabilities and other bugs, with such patches usually called bugfixes or bug fixes, and improving the usability or performance. Although meant to fix problems, poorly designed patches can sometimes introduce new problems (see software regressions). In some special cases updates may knowingly break the functionality, for instance, by removing components for which the update provider is no longer licensed or disabling a device.
alternative label: Patch

Software Repository
type: Class
subclass of: Repository
subclass of: Restriction
  on property: contains
  some values from: Software Package
type: NamedIndividual
contains: Software Package
alternative label: Package Repository
definition: A software repository, or repo for short, is a storage location for software packages. Often a table of contents is also stored, along with metadata. A software repository is typically managed by source or version control, or repository managers. Package managers allow automatically installing and updating repositories, sometimes called 'packages'.

Software Update
type: Class
subclass of: Platform Hardening
subclass of: Restriction
  on property: updates
  some values from: Software
type: NamedIndividual
kb-reference: Reference-MethodAndSystemForProvidingSoftwareUpdatesToLocalMachines
updates: Software
d3fend-id: D3-SU
definition: Replacing old software on a computer system component.

Somers' D
type: Class
subclass of: Rank Correlation
type: NamedIndividual
d3fend-id: D3A-SD

Soundex Matching
type: Class
subclass of: Partial Matching
type: NamedIndividual
d3fend-id: D3A-SM
kb-article: ## How it works The goal is for homophones to be encoded to the same representation so that they can be matched despite minor differences in spelling. The algorithm mainly encodes consonants; a vowel will not be encoded unless it is the first letter. Soundex is the most widely known of all phonetic algorithms (in part because it is a standard feature of popular database software. Improvements to Soundex are the basis for many modern phonetic algorithms. ## References 1. Soundex. (2023, April 19). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Soundex)
definition: Soundex is a phonetic algorithm for indexing names by sound, as pronounced in English.

Source Code Analyzer Tool
type: Class
subclass of: Static Analysis Tool
definition: A source code analyzer tool is a static analysis tool that operates specifically on source code, but not object code.

Source Code Hardening
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Harden
type: NamedIndividual
enables: Harden
d3fend-id: D3-SCH
definition: Hardening source code with the intention of making it more difficult to exploit and less error prone.

Source Code Reference
type: Class
subclass of: Technique Reference
pref-label: Source Code

Spearman's Rank Correlation Coefficient
type: Class
subclass of: Rank Correlation
type: NamedIndividual
d3fend-id: D3A-SRCC
synonym: Spearman's Rho

Specification Reference
type: Class
subclass of: Technique Reference
pref-label: Specification

Spectral Clustering
type: Class
subclass of: Graph-based Clustering
type: NamedIndividual
d3fend-id: D3A-SC
kb-article: ## References Towards Data Science. (n.d.). Spectral Clustering. [Link](https://towardsdatascience.com/spectral-clustering-aba2640c0d5b)
definition: Spectral clustering is a technique that identifies communities of nodes in a graph based on the edges connecting them.

Stack Component
type: Class
subclass of: Digital Information Bearer
definition: A stack component is any component of a call stack used for stack-based memory allocation in a running process. Examples include saved instruction pointers, stack frames, and stack frame canaries.

Stack Frame
type: Class
subclass of: Stack Component
subclass of: Restriction
  on property: may-contain
  some values from: Pointer
subclass of: Restriction
  on property: may-contain
  some values from: Stack Frame Canary
type: NamedIndividual
may-contain: Pointer
may-contain: Stack Frame Canary
alternative label: Activation Record
alternative label: Activation Frame
definition: A machine-dependent and application-binary-dependent (ABI-dependent) data structure containing subroutine state information including the arguments passed into the routine, the return address back to the routine's caller, and space for local variables of the routine.

Stack Frame Canary
type: Class
subclass of: Stack Component
type: NamedIndividual
definition: Stack canaries, named for their analogy to a canary in a coal mine, are used to detect a stack buffer overflow before execution of malicious code can occur. This method works by placing a small integer, the value of which is randomly chosen at program start, in memory just before the stack return pointer. Most buffer overflows overwrite memory from lower to higher memory addresses, so in order to overwrite the return pointer (and thus take control of the process) the canary value must also be overwritten. This value is checked to make sure it has not changed before a routine uses the return pointer on the stack. This technique can greatly increase the difficulty of exploiting a stack buffer overflow because it forces the attacker to gain control of the instruction pointer by some non-traditional means such as corrupting other important variables on the stack.
alternative label: Stack Canary

Stack Frame Canary Validation
type: Class
subclass of: Application Hardening
subclass of: Restriction
  on property: validates
  some values from: Stack Frame
type: NamedIndividual
kb-reference: Reference-GS BufferSecurityCheck MicrosoftDocs
kb-reference: Reference-StackSmashingProtection StackGuard RedHat
validates: Stack Frame
d3fend-id: D3-SFCV
definition: Comparing a value stored in a stack frame with a known good value in order to prevent or detect a memory segment overwrite.
kb-article: ## How it works This defense must be applied at compile-time, or via a patch to the program binary. Stack Frame Canary Verification inserts instructions at the prologue and epilogue of desired functions. In the prologue, a canary value, typically with the same size as the register size, is stored in the system of record and on the stack. Typically, the canary is loaded to where it has a memory address just below that of the saved instruction pointer and base pointer. In the epilogue, the canary value stored on the stack and, is compared to the canary value in the system of record. If the values are different, other techniques such as those in Process Eviction might be invoked, such as Process Termination to end the current process, or Executable Blacklisting to blacklist the potentially vulnerable or malfunctioning executable. Stack Frame Canary Verification is commonly used to detect potential tampering of a saved register value on the stack before it has been restored. Examples of registers with values commonly saved to the stack include the instruction pointer and the base pointer. The canary should be stored between where the start of a buffer overrun is likely, and the data to protect, in cases where the buffer size increases it will overwrite the data to be protected. On most processor architectures, including x86, x64, and ARM, a "push" operation to store data to the stack grows the stack towards a lower memory address. As in these architectures, saved register values are stored to the stack at a point in time just before space is made for the local function variables, the saved register values have a higher address than that of the local function variables. Values at increasing indexes of a buffer are written to increasing memory addresses; therefore, an overwrite in the local variable buffer could overwrite saved register values, and a stack canary between these two would be useful in detecting an overwrite. On some other processor architectures such as the…

Stack Segment
type: Class
subclass of: Process Segment
subclass of: Restriction
  on property: contains
  some values from: Stack Frame
type: NamedIndividual
contains: Stack Frame
definition: The stack segment contains the program stack, a last-in-first-out structure, typically allocated in the higher parts of memory for the process.

Stacking
type: Class
subclass of: Ensemble Learning
type: NamedIndividual
d3fend-id: D3A-STA
definition: Stacking is a method of using the results and predictions from one layer of ML models as inputs to another layer of ML models. Stacking (sometimes called stacked generalization) involves training a model to combine the predictions of several other learning algorithms.
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).

Standalone Honeynet
type: Class
subclass of: Decoy Environment
subclass of: Restriction
  on property: spoofs
  some values from: Intranet Network
type: NamedIndividual
kb-reference: Reference-DynamicSelectionAndGenerationOfAVirtualCloneForDetonationOfSuspiciousContentWithinAHoneyNetwork PaloAltoNetworksInc
spoofs: Intranet Network
d3fend-id: D3-SHN
kb-article: ## How it works A standalone honeynet does not directly interact with the real enterprise environment. It may be located near or in some portion of the enterprise address space, but it does not interact with enterprise resources. ## Considerations A standalone honeynet is a lower risk to deploy compared to connected or integrated honeynets due to its isolation from the enterprise network. However, this comes at cost in loss of fidelity and realism. Significant extra effort must be made in order to make the environment look realistic.
definition: An environment created for the purpose of attracting attackers and eliciting their behaviors that is not connected to any production enterprise systems.

Standard Deviation
type: Class
subclass of: Variability
type: NamedIndividual
d3fend-id: D3A-SD
kb-article: ## References Wikipedia. (n.d.). Standard deviation. [Link](https://en.wikipedia.org/wiki/Standard_deviation)
definition: The standard deviation is a measure of the amount of variation or dispersion of a set of values.
synonym: SD

Startup Directory
type: Class
subclass of: Directory
subclass of: Local Resource
definition: A startup directory is a directory containing executable files or links to executable files which are run when a user logs in or when a system component or service is started.

Static Analysis Tool
type: Class
subclass of: Code Analyzer
definition: A static [program] analysis tool performs an automated analysis of computer software without actually executing programs, in contrast with dynamic analysis, which is analysis performed on programs while they are executing. In most cases the analysis is performed on some version of the source code, and in the other cases, some form of the object code.
alternative label: Static Program Analysis Tool

Statistical Method
type: Class
subclass of: Analytic Technique
type: NamedIndividual
d3fend-id: D3A-SM
kb-article: ## References Wolfram MathWorld. (n.d.). Statistics. [Link](https://mathworld.wolfram.com/Statistics.html)
definition: Building methods using the mathematical study of the likelihood and probability of events occurring based on known information and inferred by taking a limited number of samples.

Step
type: Class
subclass of: Plan
subclass of: Restriction
  on property: end
  some values from: Step
subclass of: Restriction
  on property: fork
  some values from: Step
subclass of: Restriction
  on property: may-be-associated-with
  some values from: Artifact
subclass of: Restriction
  on property: next
  some values from: Step

Storage
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: may-contain
  some values from: File System
type: NamedIndividual
may-contain: File System
definition: Computer data storage, often called storage or memory, is a technology consisting of computer components and recording media used to retain digital data. It is a core function and fundamental component of computers. In the Von Neumann architecture, the CPU consists of two main parts: The control unit and the arithmetic / logic unit (ALU). The former controls the flow of data between the CPU and memory, while the latter performs arithmetic and logical operations on data.
synonym: Storage
synonym: Computer data storage

Storage Device Event
type: Class
subclass of: Hardware Device Event
subclass of: Restriction
  on property: has-participant
  some values from: Secondary Storage
definition: An event describing the activity, configuration, or errors of storage devices, including physical disks, SSDs, or logical partitions. These events often pertain to data availability, integrity, and storage health.

Storage Image
type: Class
subclass of: Computing Image
subclass of: File
definition: A storage image is a complete, encapsulated representation of a storage medium or system environment. It contains all the data, files, and configurations necessary to replicate or deploy a specific system state or software setup.

Storage Snapshot
type: Class
subclass of: Computing Snapshot
definition: A storage snapshot is a copy of a storage medium or system environment at a point in time.

Stored Procedure
type: Class
subclass of: Subroutine
type: NamedIndividual
definition: A stored procedure (also termed proc, storp, sproc, StoPro, StoredProc, StoreProc, sp, or SP) is a subroutine available to applications that access a relational database management system (RDBMS). Such procedures are stored in the database data dictionary.

String Equivalence Matching
type: Class
subclass of: Equivalence Matching
subclass of: String Pattern Matching
type: NamedIndividual
d3fend-id: D3A-SEM
kb-article: ## References 1. String-searching algorithm. (2023, April 8). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/String-searching_algorithm) 2. Types of Equality. (2007, March 2). In _WikiWikiWeb_. [Link](https://wiki.c2.com/?TypesOfEquality)
definition: String equivalence matching is a type of string pattern matching which is exact; that is, the strings being compared must have the same value for each character in their sequence and be of the same length.

String Format Function
type: Class
subclass of: Subroutine
definition: A function which creates a new string based on a format specification and correspondingi specified values.

String Pattern Matching
type: Class
subclass of: Pattern Matching
type: NamedIndividual
d3fend-id: D3A-SPM
kb-article: ## How it works A basic example of string searching is when the pattern and the searched text are arrays of elements of an alphabet (finite set) Σ. Σ may be a human language alphabet, for example, the letters A through Z and other applications may use a binary alphabet (Σ = {0,1}) or a DNA alphabet (Σ = {A,C,G,T}) in bioinformatics. In practice, the method of feasible string-search algorithm may be affected by the string encoding. In particular, if a variable-width encoding is in use, then it may be slower to find the Nth character, perhaps requiring time proportional to N. This may significantly slow some search algorithms. One of many possible solutions is to search for the sequence of code units instead, but doing so may produce false matches unless the encoding is specifically designed to avoid it. ## References 1. String-searching algorithm. (2023, April 8). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/String-searching_algorithm)
definition: String pattern-matching algorithms, also known as string-matching algorithms, are an important class of string algorithms that try to find a place where one or several strings (also called patterns) are found within a larger string or text

Strong Password Policy
type: Class
subclass of: Credential Hardening
subclass of: Restriction
  on property: strengthens
  some values from: Password
type: NamedIndividual
kb-reference: Reference-DigitalIdentityGuidelines800-63-3
kb-reference: Reference-Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords
strengthens: Password
d3fend-id: D3-SPP
definition: Modifying system configuration to increase password strength.
kb-article: ## How it works Password strength guidelines include increasing password length, permitting passwords that contain ASCII or Unicode characters, and requiring systems to screen new passwords against lists of commonly used or compromised passwords. ## Considerations Extremely complex password requirements may lead users to saving passwords in text files or picking obvious passwords that meet the policy.

StyleGAN
type: Class
subclass of: Image Synthesis GAN
type: NamedIndividual
d3fend-id: D3A-STY
synonym: Style GAN
kb-article: ## References Wikipedia. (n.d.). StyleGAN. [Link](https://en.wikipedia.org/wiki/StyleGAN)
definition: Successor to the ProGAN.

Subroutine
type: Class
subclass of: Software
type: NamedIndividual
synonym: Semantic Subroutine
definition: In different programming languages, a subroutine may be called a procedure, a function, a routine, a method, or a subprogram. The generic term callable unit is sometimes used.
synonym: Software Function
synonym: Method

Subspace Clustering
type: Class
subclass of: Correlation Clustering
type: NamedIndividual
d3fend-id: D3A-SC
kb-article: ## References Parsons, L., Haque, E., & Liu, H. (2004). Subspace Clustering for High Dimensional Data: A Review. [Link](https://www.kdd.org/exploration_files/parsons.pdf)
definition: Subspace clustering is an extension of traditional clustering that seeks to find clusters in different subspaces within a dataset.

Substring Matching
type: Class
subclass of: Partial Matching
type: NamedIndividual
d3fend-id: D3A-SM
kb-article: ## References 1. String-searching algorithm. (2023, April 8). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/String-searching_algorithm)
definition: String-searching algorithms, sometimes called string-matching algorithms, are an important class of string algorithms that try to find a place where one or several strings (also called patterns) are found within a larger string or text.

Summarizing
type: Class
subclass of: Analytical Purpose

Supervised Learning
type: Class
subclass of: Machine Learning
type: NamedIndividual
d3fend-id: D3A-SL
definition: Supervised learning establishes a relationship between the known input and output variables to conduct a predictive analysis.
kb-article: ## References Supervised learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Supervised_learning).

Supply Chain Attacker
type: Class
subclass of: Attacker
subclass of: Restriction
  on property: accesses
  some values from: Software
definition: An attacker who exploits vulnerabilities in the supply chain to compromise systems or data.

Support Vector Machine Classification
type: Class
subclass of: Classification
type: NamedIndividual
d3fend-id: D3A-SVMC
kb-article: ## References About Support Vector Machine (SVM). IBM SPSS Modeler SaaS Documentation. [Link](https://www.ibm.com/docs/en/spss-modeler/saas?topic=models-about-svm&mhsrc=ibmsearch_a&mhq=support%20vector%20machine).
definition: Support Vector Machine (SVM) is a robust classification and regression technique that maximizes the predictive accuracy of a model without overfitting the training data. SVM is particularly suited to analyzing data with very large numbers (for example, thousands) of predictor fields.

Suspend Process
type: Class
subclass of: System Call
subclass of: Restriction
  on property: suspends
  some values from: Process
type: NamedIndividual
suspends: Process

Suspend Thread
type: Class
subclass of: System Call
subclass of: Restriction
  on property: suspends
  some values from: Thread
type: NamedIndividual
suspends: Thread
definition: Suspending a thread causes the thread to stop executing user-mode code.

Switch
type: Class
subclass of: Computer Network Node
definition: A network switch (also called switching hub, bridging hub, and by the IEEE MAC bridge) is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device. A network switch is a multiport network bridge that uses MAC addresses to forward data at the data link layer (layer 2) of the OSI model. Some switches can also forward data at the network layer (layer 3) by additionally incorporating routing functionality. Such switches are commonly known as layer-3 switches or multilayer switches.
alternative label: Bridging Hub
alternative label: MAC Bridge
alternative label: Network Switch
alternative label: Switching Hub

Symbolic AI
type: Class
subclass of: Symbolic Logic
type: NamedIndividual
d3fend-id: D3A-SR
synonym: Symbolic Artificial Intelligence
kb-article: ## How it works Symbolic artificial intelligence is used in tools such as logic programming, production rules, semantic nets and frames, and it developed applications such as knowledge-based systems (in particular, expert systems), symbolic mathematics, automated theorem provers, ontologies, the semantic web, and automated planning and scheduling systems. The Symbolic AI paradigm led to seminal ideas in search, symbolic programming languages, agents, multi-agent systems, the semantic web, and the strengths and limitations of formal knowledge and reasoning systems. ## References 1. Symbolic artifical intelligence. (2023, May 23). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Symbolic_artificial_intelligence)
definition: Symbolic artificial intelligence is the term for the collection of all methods in artificial intelligence that are based on high-level symbolic (human-readable) representations of problems, logic, and search.

Symbolic Link
type: Class
subclass of: File
subclass of: File System Link
subclass of: Restriction
  on property: addresses
  some values from: File
type: NamedIndividual
addresses: File
alternative label: Softlink
definition: A symbolic link (also symlink or soft link) is a term for any file that contains a reference to another file or directory in the form of an absolute or relative path and that affects pathname resolution.
alternative label: Symlink
alternative label: Soft Link

Symbolic Logic
type: Class
subclass of: Analytic Technique
type: NamedIndividual
d3fend-id: D3A-SL
definition: Symbolic Logic, also known as formal logic, is a branch of mathematics that uses symbolic representations for logical expressions and relationships. It provides a systematic method for examining the structure of arguments and reasoning, focusing on the relationships between propositions rather than the content of those propositions.
kb-article: ## How it Works ## References 1. Symbolic Logic. (2023, June 6). In _Wolfram Mathworld_. [Link](https://mathworld.wolfram.com/SymbolicLogic.html) 2. Hughes, G. and Schagrin, M. (2023, Apr 19). Formal Logic. _Encyclopedia Brittanica_. [Link](https://www.britannica.com/topic/formal-logic) 3. Carnap, R. (1953). Introduction to Symbolic Logic and Its Applications. Dover Publications. [Link](https://archive.org/details/rudolf-carnap-introduction-to-symbolic-logic-and-its-applications/page/3/mode/2up)

Symmetric Feature-based Transfer Learning
type: Class
subclass of: Homogenous Transfer Learning
type: NamedIndividual
d3fend-id: D3A-SFTL
definition: Homogeneous symmetric transformation takes both the source feature space Xs and target feature space Xt and learns feature transformations as to project each onto a common subspace Xc for adaptation purposes. This derived subspace becomes a domain-invariant feature subspace to associate cross-domain data, and in effect, reduces marginal distribution differences.
kb-article: ## References Day, O., & Khoshgoftaar, T.M. (2017). A survey on heterogeneous transfer learning. *Journal of Big Data, 4*(1), 29. [Link](https://doi.org/10.1186/s40537-017-0089-0).

Symmetric Key
type: Class
subclass of: Cryptographic Key
definition: A symmetric key is a single key used for both encryption and decryption and used with a symmetric-key algorithm. Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext. The keys may be identical or there may be a simple transformation to go between the two keys. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link. This requirement that both parties have access to the secret key is one of the main drawbacks of symmetric key encryption, in comparison to public-key encrytption (also known as asymmetric key encryption).

System
type: Class
subclass of: Artifact
definition: An artifact (instrumentality) that combines interrelated interacting artifacts designed to work as a coherent entity. [Note that not all digital artifacts are systems nor are all systems digital artifacts.]

System Call
type: Class
subclass of: Digital Information Bearer
subclass of: Restriction
  on property: executes
  some values from: Subroutine
type: NamedIndividual
executes: Subroutine
definition: A system call is the programmatic way in which a computer program requests a service from the kernel of the operating system it is executed on. This may include hardware-related services (for example, accessing a hard disk drive), creation and execution of new processes, and communication with integral kernel services such as process scheduling. System calls provide an essential interface between a process and the operating system.
synonym: syscall

System Call Analysis
type: Class
subclass of: Process Analysis
subclass of: Restriction
  on property: analyzes
  some values from: System Call
type: NamedIndividual
analyzes: System Call
kb-reference: Reference-CredentialDumpingViaWindowsTaskManager MITRE
kb-reference: Reference-DLLInjectionViaLoadLibrary MITRE
kb-reference: Reference-Hardware-assistedSystemAndMethodForDetectingAndAnalyzingSystemCallsMadeToAnOpertingSystemKernel EndgameInc
kb-reference: Reference-MalwareDetectionInEventLoops CrowdstrikeInc
kb-reference: Reference-CAR-2020-05-001:MiniDumpOfLSASS MITRE
kb-reference: Reference-CAR-2021-05-011:CreateRemoteThreadIntoLSASS MITRE
d3fend-id: D3-SCA
definition: Analyzing system calls to determine whether a process is exhibiting unauthorized behavior.
kb-article: ## How it works System calls are APIs between a user application and the operating system [1]. By analyzing a process's use of these APIs, it is, in some cases, possible to ascertain whether a program is exhibiting unauthorized behavior, including trying to escalate its privileges. ### Gathering System Calls A common method to capture system calls is to use kernel APIs to hook [2] a process's system call invocations. The Linux system call `ptrace` tracks other system calls in a process and allows their alteration; this is made use of by GDB. `strace` utilizes `ptrace` and will print to stdout each system call invoked. Other applications record this data in local or remote databases. The log entry for each system call, which may reference additional information such as the date and time, and the process tree for the process which made the system call, is relayed, in real time or post-facto, to an analysis module which consults a catalog or model to determine whether the distribution matches a known-good or known-bad pattern. ### Analysis System calls are analyzed with a variety of methods. Some analytics look for specific sequences of instructions, others may apply statistical methods to identify abnormal behavior. Sequences of instructions can be abstracted into conceptually higher order user activities, for example: * An attacker executes many system calls in a short period of time, with several sequences which could be used to escalate privileges. * Getting the contents from a URL, writing to a new file, and then executing the same file. * A ransomware program which either uses a loop or creates many threads to: read a specified file, encrypt its contents, create an output file with a similar name to the original file, and delete the unencrypted original. ## Considerations * Duplicative or extraneous system calls may be added to malware to defeat analytics. * Malware could replace API hooking instructions to allow system calls to be made without being monitored. *…

System Call Event
type: Class
subclass of: Kernel Event
subclass of: Restriction
  on property: has-participant
  some values from: System Call
definition: An event where a user-space process requests a service or resource from the operating system kernel through a system call interface, enabling controlled interactions with hardware or kernel-level operations.

System Call Filtering
type: Class
subclass of: Access Mediation
subclass of: Restriction
  on property: filters
  some values from: System Call
subclass of: Restriction
  on property: isolates
  some values from: Process
type: NamedIndividual
filters: System Call
isolates: Process
kb-reference: Reference-AnalysisOfTheWindowsVistaSecurityModel SymantecCorporation
kb-reference: Reference-ArchitectureOfTransparentNetworkSecurityForApplicationContainers NeuvectorInc
kb-reference: Reference-OverviewOfTheSeccompSandbox
d3fend-id: D3-SCF
kb-article: ## How it works System call filtering uses a mandatory access control paradigm (that is, a non-discretionary access control) system because the rules and polices that determine access is determined by a security control authority and not distributed to local users. Access determinations are based on designed access control polices and are not based on local resource owner determinations. Access is typically granted by defining sets of subjects and sets of objects. Subjects are the entities requesting access and objects are the resources that subjects are trying to access. Rules and policies are defined that associate subjects and object permissions and access controls. ### Common implementations #### Security label access control A fine-grained form control is to apply security labels to individual resources, including processes, and the access control decisions are against a particular resource and a given user attempting to gain access. This type of control requires that the file system has built-in support for security labels. Access controls are typically implemented through the use of label identifiers for every file system object. Identifier labels are applied to resources and users are assigned a similar access identifier. Users attempting to access a resource will result in the operating system performing an access control check. The access control check will compare the assigned user's credentials to that of the resource or object they are attempting to access. A security context is associated with resources and is used to determine assess. Typical basic access control elements include users, roles and types and together they form a security context which is the basis for the security labels. This type of access control is what is employed in SELinux [2]. This form of security kernel access control is considered the most flexible implementation, but it also is the most complex to deploy across the enterprise. Where multiple virtual machines (VM) are run tog…
definition: Controlling access to local computer system resources with kernel-level capabilities.
alternative label: System Call Mediation
synonym: System Call Control
alternative label: Mandatory Access Control

System Config System Call
type: Class
subclass of: System Call

System Configuration Database
type: Class
subclass of: Database
type: NamedIndividual
definition: A database used to hold system configuration data.

System Configuration Database Record
type: Class
subclass of: Configuration Database Record
subclass of: Operating System Configuration Component
type: NamedIndividual
definition: A database record holding information used to configure the services, parameters, and initial settings for an operating system.

System Configuration Init Database Record
type: Class
subclass of: System Configuration Database Record
subclass of: System Configuration Init Resource
subclass of: System Init Configuration
type: NamedIndividual
definition: A database record holding information used to configure the services, parameters, and initial settings for an operating system at startup.
alternative label: System Configuration Startup Database Record

System Configuration Init Resource
type: Class
subclass of: Local Resource
definition: A system configuration initialization resource has information for initializing (booting) a system.
alternative label: System Init Resource

System Configuration Permissions
type: Class
subclass of: Platform Hardening
subclass of: Restriction
  on property: restricts
  some values from: System Configuration Database
type: NamedIndividual
kb-reference: Reference-HowToChangeRegistryValuesOrPermissionsFromACommandLineOrAScript
restricts: System Configuration Database
d3fend-id: D3-SCP
definition: Restricting system configuration modifications to a specific user or group of users.

System Daemon Monitoring
type: Class
subclass of: Operating System Monitoring
subclass of: Restriction
  on property: monitors
  some values from: Operating System Process
type: NamedIndividual
kb-reference: Reference-HostIntrusionPreventionSystemUsingSoftwareAndUserBehaviorAnalysis SophosLtd
kb-reference: Reference-MethodUsingKernelModeAssistanceForTheDetectionAndRemovalOfThreatsWhichAreActivelyPreventingDetectionAndRemovalFromARunningSystem SymantecCorporation
kb-reference: Reference-UserActivityFromStoppingWindowsDefensiveServices MITRE
monitors: Operating System Process
d3fend-id: D3-SDM
definition: Tracking changes to the state or configuration of critical system level processes.
kb-article: ## How it works Attackers may manipulate system settings or services to disable system logging or monitoring of security tools and events. Firewall and antivirus services are popular targets for attackers. Disabling system logs will also allow an attacker's actions to go unnoticed. Analysis of logs, registries, and process monitoring help defenders locate signs of tampering. Two possible approaches are to monitor hardened system services or to monitor registry updates for modifications to security settings.

System Dependency
type: Class
subclass of: Dependency
type: NamedIndividual
definition: A system dependency indicates a system has an activity, agent, or another system which relies on it in order to be functional.

System Dependency Mapping
type: Class
subclass of: System Mapping
subclass of: Restriction
  on property: maps
  some values from: System Dependency
type: NamedIndividual
kb-reference: Reference-CatiaUAFPlugin
kb-reference: Reference-SoftwareVulnerabilityGraphDatabase
kb-reference: Reference-UnifiedArchitectureFrameworkUAF
maps: System Dependency
d3fend-id: D3-SYSDM
definition: System dependency mapping identifies and models the dependencies of system components on each other to carry out their function.
kb-article: ## How it works The organization collects and models architectural information about the software, hardware, and products and maps the dependencies between systems, including each system's internal components and dependencies. ## Considerations * Data exchanges identified in the network mapping efforts usually indicate such dependencies, but may not be part of the intended design. * Architectural design artifacts and SMEs may need to be consulted to determine if dependencies are intended or otherwise essential. * System depedency mapping can identify internal dependencies of standard and pre-built systems that should be incorporated into a complete system dependency model. * System dependencies for critical systems--those supporting critical organizational activities--should be prioritized for supply chain risk analysis. * System dependencies should identify the integral components of a given named system and their structure to form a system. * System dependencies with a given system may be fixed by a particular product's configuration, and leveraging external knowledge bases about dependencies available (e.g., from package managers) is essential.

System File Analysis
type: Class
subclass of: Operating System Monitoring
subclass of: Restriction
  on property: analyzes
  some values from: Operating System File
type: NamedIndividual
analyzes: Operating System File
kb-reference: Reference-AccessPermissionModification MITRE
kb-reference: Reference-AutorunDifferences MITRE
kb-reference: Reference-UserActivityFromClearingEventLogs MITRE
d3fend-id: D3-SFA
kb-article: ## How it works This technique ensures the integrity of system owned file resources. System files can impact the behavior below the user level. ## Considerations * Need to manage the size of log file analysis. * False positives are a concern with this technique and filtering will need to be given additional thought. * A baseline or snapshot of file checksums should be established for future comparison.
definition: Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.

System Firewall Configuration
type: Class
subclass of: Operating System Configuration Component
subclass of: Restriction
  on property: configures
  some values from: Host-based Firewall
type: NamedIndividual
configures: Host-based Firewall
definition: The configuration for a individual host operating system's firewall.

System Firmware
type: Class
subclass of: Firmware
type: NamedIndividual
alternative label: BIOS Firmware
definition: Firmware that is installed on a computer's main board which manages the initial boot process. It can also continue to run or function after the operating system boots.
alternative label: UEFI Firmware

System Firmware Verification
type: Class
subclass of: Firmware Verification
subclass of: Restriction
  on property: verifies
  some values from: System Firmware
type: NamedIndividual
kb-reference: Reference-FirmwareVerificationEclypsium
kb-reference: Reference-PlatformFirmwareResiliencyGuidelines NIST
verifies: System Firmware
d3fend-id: D3-SFV
kb-article: ## How it works Cryptographic hash values are computed for system firmware. The hash values are compared against precomputed firmware hash values to determine if the firmware has been tampered with. When system firmware verification fails a set of predefined responses is typically invoked. The responses may direct the system to disable some devices or operations. ## Considerations * Requires the use of system provided security modules * Secure hash values will need to be computed for firmware
definition: Cryptographically verifying installed system firmware integrity.

System Init Config Analysis
type: Class
subclass of: Operating System Monitoring
subclass of: Restriction
  on property: analyzes
  some values from: System Init Configuration
type: NamedIndividual
analyzes: System Init Configuration
kb-reference: Reference-AutorunDifferences MITRE
kb-reference: Reference-CAR-2020-09-005:AppInitDLLs MITRE
kb-reference: Reference-CAR-2020-11-001:BootOrLogonInitializationScripts MITRE
d3fend-id: D3-SICA
synonym: Startup Analysis
synonym: Autorun Analysis
alternative label: System Initialization Configuration Analysis
definition: Analysis of any system process startup configuration.

System Init Configuration
type: Class
subclass of: Operating System Configuration Component
type: NamedIndividual
definition: System initialization configuration information is configuration information used to configure the services, parameters, and initial settings for an operating system at startup.
alternative label: Autoruns

System Init Process
type: Class
subclass of: Operating System Process
definition: A system initialization process is a process that executes to initialize (boot) an operating system.
alternative label: System Initialization Process
alternative label: System Startup Process

System Init Script
type: Class
subclass of: Executable Script
subclass of: System Configuration Init Resource
subclass of: System Init Configuration
type: NamedIndividual
definition: A script used to initialize and configure elements of the system's environment, applications, services, or its operating system.

System Mapping
type: Class
subclass of: Defensive Technique
subclass of: Restriction
  on property: enables
  some values from: Model
type: NamedIndividual
enables: Model
d3fend-id: D3-SYSM
definition: System mapping encompasses the techniques to identify the organization's systems, how they are configured and decomposed into subsystems and components, how they are dependent on one another, and where they are physically located.
display-order: 2

System Password Database
type: Class
subclass of: Password Database
type: NamedIndividual
definition: A password database used by a system service or process to authenticate users (e.g., Security Account Manager)

System Platform Variable
type: Class
subclass of: Runtime Variable
definition: Runtime variables which may consist of memory usage, internal temperature, operating mode, clock time, scan time, hardware status, etc.
synonym: Configuration Resource
synonym: System Data
synonym: System Properties

System Service Software
type: Class
subclass of: Software
subclass of: Restriction
  on property: contains
  some values from: Operating System File
type: NamedIndividual
contains: Operating System File
definition: Software services provided as part of the operating system, typically accessed through system calls.

System Software
type: Class
subclass of: Software
definition: Computer software which enables operating system or platform functionality.

System Startup Directory
type: Class
subclass of: Directory
subclass of: System Configuration Init Resource
subclass of: System Init Configuration
type: NamedIndividual
definition: A system startup directory is a directory containing executable files or links to executable files which are run when the system starts.

System State Image
type: Class
subclass of: Storage Image
type: NamedIndividual
definition: In computing, a system image is a serialized copy of the entire state of a computer system stored in some non-volatile form, such as a binary executable file.
alternative label: System Image

System Time Application
type: Class
subclass of: UtilitySoftware
type: NamedIndividual
definition: A system time utility is utility software that can get the system time, such as the Unix date command or Windows' Net utility.

System Utilization Record
type: Class
subclass of: Record
definition: A system utilization record is a record for the tracking of resource utilization e.g. CPU, Disk, Network, Memory Bandwidth, GPU, or other resources for a given time period.

System Vulnerability Assessment
type: Class
subclass of: System Mapping
subclass of: Restriction
  on property: evaluates
  some values from: Digital System
subclass of: Restriction
  on property: identifies
  some values from: Vulnerability
type: NamedIndividual
evaluates: Digital System
identifies: Vulnerability
kb-reference: Reference-SoftwareVulnerabilityGraphDatabase
d3fend-id: D3-SYSVA
definition: System vulnerability assessment relates all the vulnerabilities of a system's components in the context of their configuration and internal dependencies and can also include assessing risk emerging from the system's design as a whole, not just the sum of individual component vulnerabilities.

Data Obfuscation
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
attack-id: T1001
definition: Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

Junk Data
type: Class
subclass of: Data Obfuscation
attack-id: T1001.001
definition: Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

Steganography
type: Class
subclass of: Data Obfuscation
attack-id: T1001.002
definition: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.

Protocol or Service Impersonation
type: Class
subclass of: Data Obfuscation
attack-id: T1001.003
definition: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.

Data Compressed
type: Class
subclass of: Exfiltration Technique
attack-id: T1002
definition: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.
comment: This technique has been revoked by T1560
deprecated: true

OS Credential Dumping
type: Class
subclass of: Credential Access Technique
attack-id: T1003
definition: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

LSASS Memory
type: Class
subclass of: OS Credential Dumping
subclass of: Restriction
  on property: accesses
  some values from: Authentication Service
subclass of: Restriction
  on property: accesses
  some values from: Process
type: NamedIndividual
accesses: Authentication Service
accesses: Process
attack-id: T1003.001
definition: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).

Security Account Manager
type: Class
subclass of: OS Credential Dumping
subclass of: Restriction
  on property: may-access
  some values from: Authentication Service
subclass of: Restriction
  on property: may-access
  some values from: Process
subclass of: Restriction
  on property: may-access
  some values from: System Password Database
type: NamedIndividual
may-access: Authentication Service
may-access: Process
may-access: System Password Database
definition: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
attack-id: T1003.002

NTDS
type: Class
subclass of: OS Credential Dumping
subclass of: Restriction
  on property: accesses
  some values from: Encrypted Credential
type: NamedIndividual
accesses: Encrypted Credential
attack-id: T1003.003
definition: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.(Citation: Wikipedia Active Directory)

LSA Secrets
type: Class
subclass of: OS Credential Dumping
subclass of: Restriction
  on property: may-access
  some values from: Process
subclass of: Restriction
  on property: may-access
  some values from: System Password Database
type: NamedIndividual
may-access: Process
may-access: System Password Database
attack-id: T1003.004
definition: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)

Cached Domain Credentials
type: Class
subclass of: OS Credential Dumping
subclass of: Restriction
  on property: accesses
  some values from: Encrypted Credential
subclass of: Restriction
  on property: may-modify
  some values from: Log
type: NamedIndividual
accesses: Encrypted Credential
may-modify: Log
definition: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)
attack-id: T1003.005

DCSync
type: Class
subclass of: OS Credential Dumping
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
subclass of: Restriction
  on property: produces
  some values from: Intranet Administrative Network Traffic
type: NamedIndividual
may-modify: Event Log
produces: Intranet Administrative Network Traffic
definition: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.
attack-id: T1003.006

Proc Filesystem
type: Class
subclass of: OS Credential Dumping
subclass of: Restriction
  on property: accesses
  some values from: Operating System File
subclass of: Restriction
  on property: accesses
  some values from: Process Image
type: NamedIndividual
accesses: Operating System File
accesses: Process Image
attack-id: T1003.007
definition: Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space. And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: baeldung Linux proc map 2022)

/etc/passwd and /etc/shadow
type: Class
subclass of: OS Credential Dumping
subclass of: Restriction
  on property: accesses
  some values from: Encrypted Credential
subclass of: Restriction
  on property: accesses
  some values from: Password File
type: NamedIndividual
accesses: Encrypted Credential
accesses: Password File
definition: Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)
attack-id: T1003.008

Winlogon Helper DLL
type: Class
subclass of: Persistence Technique
attack-id: T1004
definition: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software\[Wow6432Node\]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013)
comment: This technique has been revoked by T1547.004
deprecated: true

Data from Local System
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: Restriction
  on property: accesses
  some values from: Local Resource
type: NamedIndividual
accesses: File
accesses: Local Resource
attack-id: T1005
definition: Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.

Direct Volume Access
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: accesses
  some values from: Volume
type: NamedIndividual
accesses: Volume
attack-id: T1006
definition: Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)

System Service Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
subclass of: Restriction
  on property: may-invoke
  some values from: Get Running Processes
type: NamedIndividual
may-invoke: Create Process
may-invoke: Get Running Processes
definition: Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start.
attack-id: T1007

Fallback Channels
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
attack-id: T1008
definition: Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Binary Padding
type: Class
subclass of: Defense Evasion Technique
attack-id: T1009
definition: Adversaries can use binary padding to add junk data and change the on-disk representation of malware without affecting the functionality or behavior of the binary. This will often increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.
comment: This technique has been revoked by T1027.001
deprecated: true

Application Window Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
subclass of: Restriction
  on property: may-invoke
  some values from: Get Open Windows
type: NamedIndividual
may-invoke: Create Process
may-invoke: Get Open Windows
attack-id: T1010
definition: Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)

Exfiltration Over Other Network Medium
type: Class
subclass of: Exfiltration Technique
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
type: NamedIndividual
produces: Internet Network Traffic
attack-id: T1011
definition: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.

Exfiltration Over Bluetooth
type: Class
subclass of: Exfiltration Over Other Network Medium
attack-id: T1011.001
definition: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.

Query Registry
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: accesses
  some values from: System Configuration Database
subclass of: Restriction
  on property: may-invoke
  some values from: Get System Config Value
type: NamedIndividual
accesses: System Configuration Database
may-invoke: Get System Config Value
attack-id: T1012
definition: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Port Monitors
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1013
definition: A port monitor can be set through the (Citation: AddMonitor) API call to set a DLL to be loaded at startup. (Citation: AddMonitor) This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.
comment: This technique has been revoked by T1547.010
deprecated: true

Rootkit
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: may-modify
  some values from: Boot Sector
subclass of: Restriction
  on property: may-modify
  some values from: Firmware
subclass of: Restriction
  on property: may-modify
  some values from: Kernel
subclass of: Restriction
  on property: may-modify
  some values from: Kernel Module
subclass of: Restriction
  on property: may-modify
  some values from: Shared Library File
type: NamedIndividual
may-modify: Boot Sector
may-modify: Firmware
may-modify: Kernel
may-modify: Kernel Module
may-modify: Shared Library File
attack-id: T1014
definition: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits)

Accessibility Features
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1015
definition: Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
comment: This technique has been revoked by T1546.008
deprecated: true

System Network Configuration Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-execute
  some values from: Executable Script
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
subclass of: Restriction
  on property: may-invoke
  some values from: Get System Network Config Value
type: NamedIndividual
may-execute: Executable Script
may-invoke: Create Process
may-invoke: Get System Network Config Value
attack-id: T1016
definition: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).

Internet Connection Discovery
type: Class
subclass of: System Network Configuration Discovery
attack-id: T1016.001
definition: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites.

Wi-Fi Discovery
type: Class
subclass of: System Network Configuration Discovery
attack-id: T1016.002
definition: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns.

Application Deployment Software
type: Class
subclass of: Lateral Movement Technique
attack-id: T1017
definition: Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform software deployment.
comment: This technique has been revoked by T1072
deprecated: true

Remote System Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-access
  some values from: Operating System Configuration File
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
subclass of: Restriction
  on property: may-invoke
  some values from: Create Socket
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
type: NamedIndividual
may-access: Operating System Configuration File
may-invoke: Create Process
may-invoke: Create Socket
produces: Network Traffic
attack-id: T1018
definition: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039).

System Firmware
type: Class
subclass of: Persistence Technique
attack-id: T1019
definition: The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)
comment: This technique has been revoked by T1542.001
deprecated: true

Automated Exfiltration
type: Class
subclass of: Exfiltration Technique
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
type: NamedIndividual
produces: Internet Network Traffic
definition: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020)
attack-id: T1020

Traffic Duplication
type: Class
subclass of: Automated Exfiltration
attack-id: T1020.001
definition: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring)

Remote Services
type: Class
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: produces
  some values from: Intranet Network Traffic
type: NamedIndividual
produces: Intranet Network Traffic
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
attack-id: T1021

Remote Desktop Protocol
type: Class
subclass of: Remote Services
subclass of: Restriction
  on property: creates
  some values from: RDP Session
subclass of: Restriction
  on property: produces
  some values from: Administrative Network Traffic
type: NamedIndividual
creates: RDP Session
produces: Administrative Network Traffic
attack-id: T1021.001
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

SMB/Windows Admin Shares
type: Class
subclass of: Remote Services
attack-id: T1021.002
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Distributed Component Object Model
type: Class
subclass of: Remote Services
attack-id: T1021.003
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.

SSH
type: Class
subclass of: Remote Services
subclass of: Restriction
  on property: creates
  some values from: SSH Session
subclass of: Restriction
  on property: produces
  some values from: Administrative Network Traffic
type: NamedIndividual
creates: SSH Session
produces: Administrative Network Traffic
attack-id: T1021.004
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

VNC
type: Class
subclass of: Remote Services
attack-id: T1021.005
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol)

Windows Remote Management
type: Class
subclass of: Remote Services
attack-id: T1021.006
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Cloud Services
type: Class
subclass of: Remote Services
attack-id: T1021.007
definition: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.

Direct Cloud VM Connections
type: Class
subclass of: Remote Services
attack-id: T1021.008
definition: Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the [Cloud API](https://attack.mitre.org/techniques/T1059/009), such as Azure Serial Console(Citation: Azure Serial Console), AWS EC2 Instance Connect(Citation: EC2 Instance Connect)(Citation: lucr-3: Getting SaaS-y in the cloud), and AWS System Manager.(Citation: AWS System Manager).

Data Encrypted
type: Class
subclass of: Exfiltration Technique
attack-id: T1022
definition: Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.
comment: This technique has been revoked by T1560
deprecated: true

Shortcut Modification
type: Class
subclass of: Persistence Technique
attack-id: T1023
definition: Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.
comment: This technique has been revoked by T1547.009
deprecated: true

Custom Cryptographic Protocol
type: Class
subclass of: Command and Control Technique
attack-id: T1024
definition: Adversaries may use a custom cryptographic protocol or algorithm to hide command and control traffic. A simple scheme, such as XOR-ing the plaintext with a fixed key, will produce a very weak ciphertext.
comment: This technique has been revoked by T1573
deprecated: true

Data from Removable Media
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: accesses
  some values from: Removable Media Device
type: NamedIndividual
accesses: Removable Media Device
definition: Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
attack-id: T1025

Multiband Communication
type: Class
subclass of: Command and Control Technique
attack-id: T1026
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
deprecated: true

Obfuscated Files or Information
type: Class
subclass of: Defense Evasion Technique
attack-id: T1027
definition: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Binary Padding
type: Class
subclass of: Obfuscated Files or Information
subclass of: Restriction
  on property: modifies
  some values from: Executable Binary
type: NamedIndividual
modifies: Executable Binary
attack-id: T1027.001
definition: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.

Software Packing
type: Class
subclass of: Obfuscated Files or Information
subclass of: Restriction
  on property: obfuscates
  some values from: Executable File
type: NamedIndividual
obfuscates: Executable File
attack-id: T1027.002
definition: Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)

Steganography
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.003
definition: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.

Compile After Delivery
type: Class
subclass of: Obfuscated Files or Information
subclass of: Restriction
  on property: creates
  some values from: Executable File
type: NamedIndividual
creates: Executable File
attack-id: T1027.004
definition: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)

Indicator Removal from Tools
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.005
definition: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.

HTML Smuggling
type: Class
subclass of: Obfuscated Files or Information
subclass of: Restriction
  on property: creates
  some values from: JavaScript Blob
subclass of: Restriction
  on property: hides
  some values from: Digital Artifact
type: NamedIndividual
creates: JavaScript Blob
hides: Digital Artifact
attack-id: T1027.006
definition: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018)

Dynamic API Resolution
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.007
definition: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.

Stripped Payloads
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.008
definition: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018)

Embedded Payloads
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.009
definition: Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs)

Command Obfuscation
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.010
definition: Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)

Fileless Storage
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.011
definition: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless)

LNK Icon Smuggling
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.012
definition: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.

Encrypted/Encoded File
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.013
definition: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use.

Polymorphic Code
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.014
definition: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone)

Compression
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.015
definition: Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., [Fileless Storage](https://attack.mitre.org/techniques/T1027/011)).(Citation: Trustwave Pillowmint June 2020)

Junk Code Insertion
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.016
definition: Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code)

SVG Smuggling
type: Class
subclass of: Obfuscated Files or Information
attack-id: T1027.017
definition: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include ` ` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files.

Windows Remote Management
type: Class
subclass of: Execution Technique
subclass of: Lateral Movement Technique
attack-id: T1028
definition: Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). (Citation: Microsoft WinRM) It may be called with the winrm command or by any number of programs such as PowerShell. (Citation: Jacobsen 2014)
comment: This technique has been revoked by T1021.006
deprecated: true

Scheduled Transfer
type: Class
subclass of: Exfiltration Technique
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
type: NamedIndividual
produces: Internet Network Traffic
attack-id: T1029
definition: Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.

Data Transfer Size Limits
type: Class
subclass of: Exfiltration Technique
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
type: NamedIndividual
produces: Internet Network Traffic
definition: An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
attack-id: T1030

Modify Existing Service
type: Class
subclass of: Persistence Technique
attack-id: T1031
definition: Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).
comment: This technique has been revoked by T1543.003
deprecated: true

Standard Cryptographic Protocol
type: Class
subclass of: Command and Control Technique
attack-id: T1032
definition: Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.
comment: This technique has been revoked by T1573
deprecated: true

System Owner/User Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-access
  some values from: Directory Service
subclass of: Restriction
  on property: may-access
  some values from: Get System Config Value
subclass of: Restriction
  on property: may-access
  some values from: Password File
subclass of: Restriction
  on property: may-access
  some values from: Process Segment
subclass of: Restriction
  on property: may-invoke
  some values from: Copy Token
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
type: NamedIndividual
may-access: Directory Service
may-access: Get System Config Value
may-access: Password File
may-access: Process Segment
may-invoke: Copy Token
may-invoke: Create Process
attack-id: T1033
definition: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Path Interception
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1034
definition: **This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**
comment: **This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**
deprecated: true

Service Execution
type: Class
subclass of: Execution Technique
attack-id: T1035
definition: Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.
comment: This technique has been revoked by T1569.002
deprecated: true

Masquerading
type: Class
subclass of: Defense Evasion Technique
attack-id: T1036
definition: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Invalid Code Signature
type: Class
subclass of: Masquerading
subclass of: Restriction
  on property: creates
  some values from: Executable Binary
type: NamedIndividual
creates: Executable Binary
attack-id: T1036.001
definition: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)

Right-to-Left Override
type: Class
subclass of: Masquerading
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
type: NamedIndividual
modifies: File System Metadata
attack-id: T1036.002
definition: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 xcod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_regnp.js will be displayed as photo_high_resj.png.(Citation: Infosecinstitute RTLO Technique)

Rename Legitimate Utilities
type: Class
subclass of: Masquerading
subclass of: Restriction
  on property: may-create
  some values from: Executable File
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Executable File
type: NamedIndividual
may-create: Executable File
may-modify: Operating System Executable File
definition: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). (Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)
attack-id: T1036.003

Masquerade Task or Service
type: Class
subclass of: Masquerading
subclass of: Restriction
  on property: modifies
  some values from: Job Schedule
type: NamedIndividual
modifies: Job Schedule
attack-id: T1036.004
definition: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.

Match Legitimate Resource Name or Location
type: Class
subclass of: Masquerading
subclass of: Restriction
  on property: invokes
  some values from: Move File
subclass of: Restriction
  on property: may-create
  some values from: File
type: NamedIndividual
invokes: Move File
may-create: File
attack-id: T1036.005
definition: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.

Space after Filename
type: Class
subclass of: Masquerading
subclass of: Restriction
  on property: creates
  some values from: File
type: NamedIndividual
creates: File
attack-id: T1036.006
definition: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.

Double File Extension
type: Class
subclass of: Masquerading
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
type: NamedIndividual
modifies: File System Metadata
attack-id: T1036.007
definition: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension)

Masquerade File Type
type: Class
subclass of: Masquerading
attack-id: T1036.008
definition: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`.

Break Process Trees
type: Class
subclass of: Masquerading
attack-id: T1036.009
definition: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022)

Masquerade Account Name
type: Class
subclass of: Masquerading
attack-id: T1036.010
definition: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023)

Overwrite Process Arguments
type: Class
subclass of: Masquerading
attack-id: T1036.011
definition: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges.

Boot or Logon Initialization Scripts
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1037
definition: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.

Logon Script (Windows)
type: Class
subclass of: Boot or Logon Initialization Scripts
subclass of: Restriction
  on property: modifies
  some values from: UserInitScript
type: NamedIndividual
modifies: UserInitScript
definition: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.(Citation: Hexacorn Logon Scripts)
attack-id: T1037.001

Login Hook
type: Class
subclass of: Boot or Logon Initialization Scripts
subclass of: Restriction
  on property: modifies
  some values from: UserInitScript
type: NamedIndividual
modifies: UserInitScript
attack-id: T1037.002
definition: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev)

Network Logon Script
type: Class
subclass of: Boot or Logon Initialization Scripts
subclass of: Restriction
  on property: modifies
  some values from: Network Init Script File Resource
type: NamedIndividual
modifies: Network Init Script File Resource
attack-id: T1037.003
definition: Group Policy Object / Active Directory Users and Computers are both Active Directory-based.

RC Scripts
type: Class
subclass of: Boot or Logon Initialization Scripts
subclass of: Restriction
  on property: modifies
  some values from: System Init Script
type: NamedIndividual
modifies: System Init Script
attack-id: T1037.004
definition: Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.

Startup Items
type: Class
subclass of: Boot or Logon Initialization Scripts
subclass of: Restriction
  on property: modifies
  some values from: System Startup Directory
type: NamedIndividual
modifies: System Startup Directory
attack-id: T1037.005
definition: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items)

DLL Search Order Hijacking
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1038
definition: Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft DLL Search) Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.
comment: This technique has been revoked by T1574.001
deprecated: true

Data from Network Shared Drive
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: accesses
  some values from: Network File Share Resource
type: NamedIndividual
accesses: Network File Share Resource
attack-id: T1039
definition: Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.

Network Sniffing
type: Class
subclass of: Credential Access Technique
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-produce
  some values from: DNS Lookup
type: NamedIndividual
may-produce: DNS Lookup
definition: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
attack-id: T1040

Exfiltration Over C2 Channel
type: Class
subclass of: Exfiltration Technique
subclass of: Restriction
  on property: may-transfer
  some values from: Certificate File
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
type: NamedIndividual
may-transfer: Certificate File
produces: Internet Network Traffic
definition: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
attack-id: T1041

Change Default File Association
type: Class
subclass of: Persistence Technique
attack-id: T1042
definition: When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access (Citation: Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or by administrators using the built-in assoc utility. (Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
comment: This technique has been revoked by T1546.001
deprecated: true

Commonly Used Port
type: Class
subclass of: Command and Control Technique
attack-id: T1043
definition: **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.**
comment: **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.**
deprecated: true

File System Permissions Weakness
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1044
definition: Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
comment: This technique has been revoked by T1574.010
deprecated: true

Software Packing
type: Class
subclass of: Defense Evasion Technique
attack-id: T1045
definition: Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.
comment: This technique has been revoked by T1027.002
deprecated: true

Network Service Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1046
definition: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)

Windows Management Instrumentation
type: Class
subclass of: Execution Technique
subclass of: Restriction
  on property: may-create
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
type: NamedIndividual
may-create: Intranet Administrative Network Traffic
may-invoke: Create Process
attack-id: T1047
definition: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components.

Exfiltration Over Alternative Protocol
type: Class
subclass of: Exfiltration Technique
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
type: NamedIndividual
produces: Internet Network Traffic
attack-id: T1048
definition: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Exfiltration Over Symmetric Encrypted Non-C2 Protocol
type: Class
subclass of: Exfiltration Over Alternative Protocol
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Traffic
type: NamedIndividual
produces: Outbound Internet Encrypted Traffic
definition: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
attack-id: T1048.001

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
type: Class
subclass of: Exfiltration Over Alternative Protocol
subclass of: Restriction
  on property: may-transfer
  some values from: Certificate File
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Traffic
type: NamedIndividual
may-transfer: Certificate File
produces: Outbound Internet Encrypted Traffic
definition: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
attack-id: T1048.002

Exfiltration Over Unencrypted Non-C2 Protocol
type: Class
subclass of: Exfiltration Over Alternative Protocol
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
definition: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco)
attack-id: T1048.003

System Network Connections Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-invoke
  some values from: Get Open Sockets
type: NamedIndividual
may-invoke: Get Open Sockets
definition: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
attack-id: T1049

New Service
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1050
definition: When operating systems boot up, they can start programs or applications called services that perform background system functions. (Citation: TechNet Services) A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry.
comment: This technique has been revoked by T1543.003
deprecated: true

Shared Webroot
type: Class
subclass of: Lateral Movement Technique
attack-id: T1051
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
deprecated: true

Exfiltration Over Physical Medium
type: Class
subclass of: Exfiltration Technique
attack-id: T1052
definition: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Exfiltration over USB
type: Class
subclass of: Exfiltration Over Physical Medium
subclass of: Restriction
  on property: modifies
  some values from: Removable Media Device
type: NamedIndividual
modifies: Removable Media Device
definition: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
attack-id: T1052.001

Scheduled Task/Job
type: Class
subclass of: Execution Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
subclass of: Restriction
  on property: executes
  some values from: Scheduled Job
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: modifies
  some values from: Job Schedule
type: NamedIndividual
executes: Scheduled Job
invokes: Create Process
modifies: Job Schedule
attack-id: T1053
definition: The sub-techniques of this are specific software implementations of scheduling capabilities.

At (Linux) Execution
type: Class
subclass of: Scheduled Task/Job
attack-id: T1053.001
definition: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)
comment: This technique has been revoked by T1053.002
deprecated: true

At
type: Class
subclass of: Scheduled Task/Job
attack-id: T1053.002
definition: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group.

Cron
type: Class
subclass of: Scheduled Task/Job
attack-id: T1053.003
definition: Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.

Launchd
type: Class
subclass of: Scheduled Task/Job
subclass of: Restriction
  on property: creates
  some values from: Property List File
type: NamedIndividual
creates: Property List File
comment: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.
definition: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.
attack-id: T1053.004
deprecated: true

Scheduled Task
type: Class
subclass of: Scheduled Task/Job
subclass of: Restriction
  on property: executes
  some values from: Scheduled Job
type: NamedIndividual
executes: Scheduled Job
definition: Renamed from ATT&CK to be consistent with at, launchd, cron siblings; name as is looks like parent. Not sure why parent is not just Scheduled Task [Execution[.
attack-id: T1053.005

Systemd Timers
type: Class
subclass of: Scheduled Task/Job
attack-id: T1053.006
definition: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)

Container Orchestration Job
type: Class
subclass of: Scheduled Task/Job
attack-id: T1053.007
definition: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

Indicator Blocking
type: Class
subclass of: Defense Evasion Technique
attack-id: T1054
definition: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1086) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).
comment: This technique has been revoked by T1562.006
deprecated: true

Process Injection
type: Class
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique
attack-id: T1055
definition: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Dynamic-link Library Injection
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: adds
  some values from: Shared Library File
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Restriction
  on property: loads
  some values from: Shared Library File
type: NamedIndividual
adds: Shared Library File
invokes: System Call
loads: Shared Library File
attack-id: T1055.001
definition: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.

Portable Executable Injection
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: may-add
  some values from: Object File
type: NamedIndividual
may-add: Object File
attack-id: T1055.002
definition: Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.

Thread Execution Hijacking
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Restriction
  on property: may-add
  some values from: Executable Binary
type: NamedIndividual
invokes: System Call
may-add: Executable Binary
definition: Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.
attack-id: T1055.003

Asynchronous Procedure Call
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
type: NamedIndividual
may-invoke: Create Process
attack-id: T1055.004
definition: Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.

Thread Local Storage
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: invokes
  some values from: System Call
type: NamedIndividual
invokes: System Call
definition: Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.
attack-id: T1055.005

Ptrace System Calls
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: invokes
  some values from: System Call
type: NamedIndividual
invokes: System Call
definition: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
attack-id: T1055.008

Proc Memory
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: accesses
  some values from: Operating System File
subclass of: Restriction
  on property: may-modify
  some values from: Operating System File
type: NamedIndividual
accesses: Operating System File
may-modify: Operating System File
attack-id: T1055.009
definition: Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process.

Extra Window Memory Injection
type: Class
subclass of: Process Injection
attack-id: T1055.011
definition: Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.

Process Hollowing
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: modifies
  some values from: Process Code Segment
type: NamedIndividual
modifies: Process Code Segment
attack-id: T1055.012
definition: Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Process Doppelgänging
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: invokes
  some values from: Create Process
type: NamedIndividual
invokes: Create Process
definition: Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.
attack-id: T1055.013

VDSO Hijacking
type: Class
subclass of: Process Injection
subclass of: Restriction
  on property: accesses
  some values from: Shared Library File
subclass of: Restriction
  on property: invokes
  some values from: System Call
type: NamedIndividual
accesses: Shared Library File
invokes: System Call
definition: Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process.
attack-id: T1055.014

ListPlanting
type: Class
subclass of: Process Injection
attack-id: T1055.015
definition: Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.

Input Capture
type: Class
subclass of: Collection Technique
subclass of: Credential Access Technique
attack-id: T1056
definition: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).

Keylogging
type: Class
subclass of: Input Capture
subclass of: Restriction
  on property: accesses
  some values from: Keyboard Input Device
type: NamedIndividual
accesses: Keyboard Input Device
attack-id: T1056.001
definition: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021)

GUI Input Capture
type: Class
subclass of: Input Capture
subclass of: Restriction
  on property: accesses
  some values from: Graphical User Interface
type: NamedIndividual
accesses: Graphical User Interface
attack-id: T1056.002
definition: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).

Web Portal Capture
type: Class
subclass of: Input Capture
subclass of: Restriction
  on property: modifies
  some values from: WebServerApplication
type: NamedIndividual
modifies: WebServerApplication
attack-id: T1056.003
definition: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.

Credential API Hooking
type: Class
subclass of: Input Capture
subclass of: Restriction
  on property: may-modify
  some values from: Process Code Segment
type: NamedIndividual
may-modify: Process Code Segment
definition: Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
attack-id: T1056.004

Process Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
subclass of: Restriction
  on property: may-invoke
  some values from: Get Running Processes
type: NamedIndividual
may-invoke: Create Process
may-invoke: Get Running Processes
attack-id: T1057
definition: Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Service Registry Permissions Weakness
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1058
definition: Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1086), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: MSDN Registry Key Security)
comment: This technique has been revoked by T1574.011
deprecated: true

Command and Scripting Interpreter
type: Class
subclass of: Execution Technique
subclass of: Restriction
  on property: executes
  some values from: Executable Script
type: NamedIndividual
executes: Executable Script
attack-id: T1059
definition: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

PowerShell
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.001
definition: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

AppleScript
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.002
definition: Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.

Windows Command Shell
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.003
definition: Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows)

Unix Shell
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.004
definition: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
alternative label: Bash Execution

Visual Basic
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.005
definition: Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)

Python
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.006
definition: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)

JavaScript
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.007
definition: Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)

Network Device CLI
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.008
definition: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands.

Cloud API
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.009
definition: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006).

AutoHotKey & AutoIT
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.010
definition: Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey)

Lua
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.011
definition: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State).(Citation: Lua main page)(Citation: Lua state)

Hypervisor CLI
type: Class
subclass of: Command and Scripting Interpreter
attack-id: T1059.012
definition: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts.

Registry Run Keys / Startup Folder
type: Class
subclass of: Persistence Technique
attack-id: T1060
definition: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.
comment: This technique has been revoked by T1547.001
deprecated: true

Graphical User Interface
type: Class
subclass of: Execution Technique
attack-id: T1061
definition: **This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.**
comment: **This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.**
deprecated: true

Hypervisor
type: Class
subclass of: Persistence Technique
attack-id: T1062
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
deprecated: true

Security Software Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1063
definition: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1063) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
comment: This technique has been revoked by T1518.001
deprecated: true

Scripting
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1064
definition: **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**
comment: **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**
deprecated: true

Uncommonly Used Port
type: Class
subclass of: Command and Control Technique
attack-id: T1065
definition: Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.
comment: This technique has been revoked by T1571
deprecated: true

Indicator Removal from Tools
type: Class
subclass of: Defense Evasion Technique
attack-id: T1066
definition: If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
comment: This technique has been revoked by T1027.005
deprecated: true

Bootkit
type: Class
subclass of: Persistence Technique
attack-id: T1067
definition: A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: MTrends 2016)
comment: This technique has been revoked by T1542.003
deprecated: true

Exploitation for Privilege Escalation
type: Class
subclass of: Privilege Escalation Technique
subclass of: Restriction
  on property: enables
  some values from: Privilege Escalation
subclass of: Restriction
  on property: may-modify
  some values from: Stack Frame
subclass of: Restriction
  on property: modifies
  some values from: Process Code Segment
type: NamedIndividual
enables: Privilege Escalation
may-modify: Stack Frame
modifies: Process Code Segment
attack-id: T1068
definition: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Permission Groups Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1069
definition: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

Local Groups
type: Class
subclass of: Permission Groups Discovery
attack-id: T1069.001
definition: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Domain Groups
type: Class
subclass of: Permission Groups Discovery
attack-id: T1069.002
definition: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Cloud Groups
type: Class
subclass of: Permission Groups Discovery
attack-id: T1069.003
definition: Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.

Indicator Removal
type: Class
subclass of: Defense Evasion Technique
attack-id: T1070
definition: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Clear Windows Event Logs
type: Class
subclass of: Indicator Removal
subclass of: Restriction
  on property: modifies
  some values from: Event Log
type: NamedIndividual
modifies: Event Log
definition: Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
attack-id: T1070.001

Clear Linux or Mac System Logs
type: Class
subclass of: Indicator Removal
subclass of: Restriction
  on property: modifies
  some values from: Operating System Log File
type: NamedIndividual
modifies: Operating System Log File
attack-id: T1070.002
definition: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

Clear Command History
type: Class
subclass of: Indicator Removal
subclass of: Restriction
  on property: modifies
  some values from: Command History Log
type: NamedIndividual
modifies: Command History Log
attack-id: T1070.003
definition: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

File Deletion
type: Class
subclass of: Indicator Removal
subclass of: Restriction
  on property: deletes
  some values from: File
subclass of: Restriction
  on property: may-modify
  some values from: File
type: NamedIndividual
deletes: File
may-modify: File
attack-id: T1070.004
definition: Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Network Share Connection Removal
type: Class
subclass of: Indicator Removal
subclass of: Restriction
  on property: unmounts
  some values from: Network File Share Resource
type: NamedIndividual
unmounts: Network File Share Resource
attack-id: T1070.005
definition: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)

Timestomp
type: Class
subclass of: Indicator Removal
subclass of: Restriction
  on property: forges
  some values from: File System Metadata
type: NamedIndividual
forges: File System Metadata
definition: Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
attack-id: T1070.006

Clear Network Connection History and Configurations
type: Class
subclass of: Indicator Removal
attack-id: T1070.007
definition: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.

Clear Mailbox Data
type: Class
subclass of: Indicator Removal
attack-id: T1070.008
definition: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.

Clear Persistence
type: Class
subclass of: Indicator Removal
attack-id: T1070.009
definition: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022)

Relocate Malware
type: Class
subclass of: Indicator Removal
attack-id: T1070.010
definition: Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts.

Application Layer Protocol
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: may-transfer
  some values from: Certificate File
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
may-transfer: Certificate File
produces: Outbound Internet Network Traffic
pref-label: Application Layer Protocol C2
attack-id: T1071
definition: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Web Protocols
type: Class
subclass of: Application Layer Protocol
subclass of: Restriction
  on property: may-transfer
  some values from: Certificate File
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Web Traffic
type: NamedIndividual
may-transfer: Certificate File
produces: Outbound Internet Web Traffic
definition: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
attack-id: T1071.001

File Transfer Protocols
type: Class
subclass of: Application Layer Protocol
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet File Transfer Traffic
type: NamedIndividual
produces: Outbound Internet File Transfer Traffic
attack-id: T1071.002
definition: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Mail Protocols
type: Class
subclass of: Application Layer Protocol
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Mail Traffic
type: NamedIndividual
produces: Outbound Internet Mail Traffic
attack-id: T1071.003
definition: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

DNS
type: Class
subclass of: Application Layer Protocol
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet DNS Lookup Traffic
type: NamedIndividual
produces: Outbound Internet DNS Lookup Traffic
attack-id: T1071.004
definition: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Publish/Subscribe Protocols
type: Class
subclass of: Application Layer Protocol
attack-id: T1071.005
definition: Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Software Deployment Tools
type: Class
subclass of: Execution Technique
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: adds
  some values from: File
subclass of: Restriction
  on property: executes
  some values from: Software Deployment Tool
subclass of: Restriction
  on property: installs
  some values from: Software
type: NamedIndividual
adds: File
executes: Software Deployment Tool
installs: Software
attack-id: T1072
definition: Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.

DLL Side-Loading
type: Class
subclass of: Defense Evasion Technique
attack-id: T1073
definition: Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: MSDN Manifests) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL. (Citation: Stewart 2014)
comment: This technique has been revoked by T1574.002
deprecated: true

Data Staged
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: reads
  some values from: Resource
type: NamedIndividual
reads: Resource
definition: Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)
attack-id: T1074

Local Data Staging
type: Class
subclass of: Data Staged
subclass of: Restriction
  on property: may-create
  some values from: File
subclass of: Restriction
  on property: may-invoke
  some values from: Create File
type: NamedIndividual
may-create: File
may-invoke: Create File
attack-id: T1074.001
definition: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.

Remote Data Staging
type: Class
subclass of: Data Staged
subclass of: Restriction
  on property: modifies
  some values from: Network Resource
type: NamedIndividual
modifies: Network Resource
attack-id: T1074.002
definition: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.

Pass the Hash
type: Class
subclass of: Lateral Movement Technique
attack-id: T1075
definition: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.
comment: This technique has been revoked by T1550.002
deprecated: true

Remote Desktop Protocol
type: Class
subclass of: Lateral Movement Technique
attack-id: T1076
definition: Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.
comment: This technique has been revoked by T1021.001
deprecated: true

Windows Admin Shares
type: Class
subclass of: Lateral Movement Technique
attack-id: T1077
definition: Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$.
comment: This technique has been revoked by T1021.002
deprecated: true

Valid Accounts
type: Class
subclass of: Defense Evasion Technique
subclass of: Initial Access Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: produces
  some values from: Authorization
subclass of: Restriction
  on property: uses
  some values from: UserAccount
type: NamedIndividual
produces: Authentication
produces: Authorization
uses: UserAccount
attack-id: T1078
definition: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Default Accounts
type: Class
subclass of: Valid Accounts
subclass of: Restriction
  on property: uses
  some values from: Default User Account
type: NamedIndividual
uses: Default User Account
definition: Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)
attack-id: T1078.001

Domain Accounts
type: Class
subclass of: Valid Accounts
subclass of: Restriction
  on property: uses
  some values from: Domain User Account
type: NamedIndividual
uses: Domain User Account
attack-id: T1078.002
definition: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)

Local Accounts
type: Class
subclass of: Valid Accounts
subclass of: Restriction
  on property: uses
  some values from: Local User Account
type: NamedIndividual
uses: Local User Account
definition: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
attack-id: T1078.003

Cloud Accounts
type: Class
subclass of: Valid Accounts
subclass of: Restriction
  on property: uses
  some values from: Cloud User Account
type: NamedIndividual
uses: Cloud User Account
attack-id: T1078.004
definition: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)

Multilayer Encryption
type: Class
subclass of: Command and Control Technique
attack-id: T1079
definition: An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.
comment: This technique has been revoked by T1573
deprecated: true

Taint Shared Content
type: Class
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: modifies
  some values from: Network Resource
type: NamedIndividual
modifies: Network Resource
attack-id: T1080

Credentials in Files
type: Class
subclass of: Credential Access Technique
attack-id: T1081
definition: Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
comment: This technique has been revoked by T1552.001
deprecated: true

System Information Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-access
  some values from: Decoy Artifact
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
type: NamedIndividual
may-access: Decoy Artifact
may-invoke: Create Process
attack-id: T1082
definition: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

File and Directory Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: accesses
  some values from: Directory
subclass of: Restriction
  on property: accesses
  some values from: File
type: NamedIndividual
accesses: Directory
accesses: File
attack-id: T1083
definition: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Windows Management Instrumentation Event Subscription
type: Class
subclass of: Persistence Technique
attack-id: T1084
definition: Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension). (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer's uptime. (Citation: Kazanciyan 2014) Several threat groups have reportedly used this technique to maintain persistence. (Citation: Mandiant M-Trends 2015)
comment: This technique has been revoked by T1546.003
deprecated: true

Rundll32
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1085
definition: The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.
comment: This technique has been revoked by T1218.011
deprecated: true

PowerShell
type: Class
subclass of: Execution Technique
attack-id: T1086
definition: PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer.
comment: This technique has been revoked by T1059.001
deprecated: true

Account Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1087
definition: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Local Account
type: Class
subclass of: Account Discovery
subclass of: Restriction
  on property: enumerates
  some values from: Local User Account
type: NamedIndividual
enumerates: Local User Account
attack-id: T1087.001
definition: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Domain Account
type: Class
subclass of: Account Discovery
subclass of: Restriction
  on property: enumerates
  some values from: Domain User Account
type: NamedIndividual
enumerates: Domain User Account
definition: Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
attack-id: T1087.002

Email Account
type: Class
subclass of: Account Discovery
attack-id: T1087.003
definition: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)

Cloud Account
type: Class
subclass of: Account Discovery
subclass of: Restriction
  on property: enumerates
  some values from: Cloud User Account
type: NamedIndividual
enumerates: Cloud User Account
attack-id: T1087.004
definition: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Bypass User Account Control
type: Class
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique
attack-id: T1088
definition: Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)
comment: This technique has been revoked by T1548.002
deprecated: true

Disabling Security Tools
type: Class
subclass of: Defense Evasion Technique
attack-id: T1089
definition: Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.
comment: This technique has been revoked by T1562.001
deprecated: true

Proxy
type: Class
subclass of: Command and Control Technique
attack-id: T1090
definition: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Internal Proxy
type: Class
subclass of: Proxy
subclass of: Restriction
  on property: produces
  some values from: Intranet Network Traffic
type: NamedIndividual
produces: Intranet Network Traffic
definition: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.
attack-id: T1090.001

External Proxy
type: Class
subclass of: Proxy
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
attack-id: T1090.002
definition: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.

Multi-hop Proxy
type: Class
subclass of: Proxy
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
definition: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
attack-id: T1090.003

Domain Fronting
type: Class
subclass of: Proxy
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Web Traffic
type: NamedIndividual
produces: Outbound Internet Encrypted Web Traffic
definition: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).
attack-id: T1090.004

Replication Through Removable Media
type: Class
subclass of: Initial Access Technique
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: executes
  some values from: Removable Media Device
type: NamedIndividual
executes: Removable Media Device
definition: Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
attack-id: T1091

Communication Through Removable Media
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: modifies
  some values from: Removable Media Device
type: NamedIndividual
modifies: Removable Media Device
attack-id: T1092
definition: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.

Process Hollowing
type: Class
subclass of: Defense Evasion Technique
attack-id: T1093
definition: Process hollowing occurs when a process is created in a suspended state then its memory is unmapped and replaced with malicious code. Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), execution of the malicious code is masked under a legitimate process and may evade defenses and detection analysis. (Citation: Leitch Hollowing) (Citation: Elastic Process Injection July 2017)
comment: This technique has been revoked by T1055.012
deprecated: true

Custom Command and Control Protocol
type: Class
subclass of: Command and Control Technique
attack-id: T1094
definition: Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing [Application Layer Protocol](https://attack.mitre.org/techniques/T1071). Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.
comment: This technique has been revoked by T1095
deprecated: true

Non-Application Layer Protocol
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
attack-id: T1095
definition: Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

NTFS File Attributes
type: Class
subclass of: Defense Evasion Technique
attack-id: T1096
definition: Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)
comment: This technique has been revoked by T1564.004
deprecated: true

Pass the Ticket
type: Class
subclass of: Lateral Movement Technique
attack-id: T1097
definition: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
comment: This technique has been revoked by T1550.003
deprecated: true

Account Manipulation
type: Class
subclass of: Persistence Technique
subclass of: Restriction
  on property: modifies
  some values from: UserAccount
type: NamedIndividual
modifies: UserAccount
attack-id: T1098
definition: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Additional Cloud Credentials
type: Class
subclass of: Account Manipulation
subclass of: Restriction
  on property: creates
  some values from: Credential
subclass of: Restriction
  on property: produces
  some values from: Intranet Administrative Network Traffic
type: NamedIndividual
creates: Credential
produces: Intranet Administrative Network Traffic
attack-id: T1098.001
definition: Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Additional Email Delegate Permissions
type: Class
subclass of: Account Manipulation
subclass of: Restriction
  on property: modifies
  some values from: Domain User Account
type: NamedIndividual
modifies: Domain User Account
attack-id: T1098.002
definition: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.

Additional Cloud Roles
type: Class
subclass of: Account Manipulation
subclass of: Restriction
  on property: modifies
  some values from: Global User Account
type: NamedIndividual
modifies: Global User Account
attack-id: T1098.003
definition: An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)

SSH Authorized Keys
type: Class
subclass of: Account Manipulation
attack-id: T1098.004
definition: Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys.(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled. The SSH config file is usually located under /etc/ssh/sshd_config.

Device Registration
type: Class
subclass of: Account Manipulation
attack-id: T1098.005
definition: Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Additional Container Cluster Roles
type: Class
subclass of: Account Manipulation
attack-id: T1098.006
definition: An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)

Additional Local or Domain Groups
type: Class
subclass of: Account Manipulation
attack-id: T1098.007
definition: An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.

Timestomp
type: Class
subclass of: Defense Evasion Technique
attack-id: T1099
definition: Adversaries may take actions to hide the deployment of new, or modification of existing files to obfuscate their activities. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools. Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools. (Citation: WindowsIR Anti-Forensic Techniques)
comment: This technique has been revoked by T1070.006
deprecated: true

Web Shell
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1100
definition: A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013)
comment: This technique has been revoked by T1505.003
deprecated: true

Security Support Provider
type: Class
subclass of: Persistence Technique
attack-id: T1101
definition: Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.
comment: This technique has been revoked by T1547.005
deprecated: true

Web Service
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Web Traffic
type: NamedIndividual
produces: Outbound Internet Web Traffic
definition: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
attack-id: T1102

Dead Drop Resolver
type: Class
subclass of: Web Service
attack-id: T1102.001
definition: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Bidirectional Communication
type: Class
subclass of: Web Service
attack-id: T1102.002
definition: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

One-Way Communication
type: Class
subclass of: Web Service
attack-id: T1102.003
definition: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.

AppInit DLLs
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1103
definition: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)
comment: This technique has been revoked by T1546.010
deprecated: true

Multi-Stage Channels
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
definition: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.
attack-id: T1104

Ingress Tool Transfer
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
definition: Session is initiated by the client, and may be a custom protocol which is why it is related to generic network traffic instead of file transfer network traffic.
attack-id: T1105

Native API
type: Class
subclass of: Execution Technique
subclass of: Restriction
  on property: invokes
  some values from: System Call
type: NamedIndividual
invokes: System Call
definition: Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
attack-id: T1106

File Deletion
type: Class
subclass of: Defense Evasion Technique
attack-id: T1107
definition: Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
comment: This technique has been revoked by T1070.004
deprecated: true

Redundant Access
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
attack-id: T1108
definition: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**
comment: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**
deprecated: true

Component Firmware
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
attack-id: T1109
definition: Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1019) but conducted upon other system components that may not have the same capability or level of integrity checking. Malicious device firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
comment: This technique has been revoked by T1542.002
deprecated: true

Brute Force
type: Class
subclass of: Credential Access Technique
attack-id: T1110
definition: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Password Guessing
type: Class
subclass of: Brute Force
subclass of: Restriction
  on property: accesses
  some values from: Password
subclass of: Restriction
  on property: modifies
  some values from: Authentication Log
subclass of: Restriction
  on property: produces
  some values from: Authentication
type: NamedIndividual
accesses: Password
modifies: Authentication Log
produces: Authentication
attack-id: T1110.001
definition: Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.

Password Cracking
type: Class
subclass of: Brute Force
subclass of: Restriction
  on property: accesses
  some values from: Password
type: NamedIndividual
accesses: Password
attack-id: T1110.002
definition: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Further, adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: US-CERT-TA18-106A)

Password Spraying
type: Class
subclass of: Brute Force
subclass of: Restriction
  on property: accesses
  some values from: Password
subclass of: Restriction
  on property: may-create
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: modifies
  some values from: Authentication Log
subclass of: Restriction
  on property: produces
  some values from: Authentication
type: NamedIndividual
accesses: Password
may-create: Intranet Administrative Network Traffic
modifies: Authentication Log
produces: Authentication
attack-id: T1110.003
definition: Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)

Credential Stuffing
type: Class
subclass of: Brute Force
subclass of: Restriction
  on property: may-create
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: modifies
  some values from: Authentication Log
subclass of: Restriction
  on property: produces
  some values from: Authentication
type: NamedIndividual
may-create: Intranet Administrative Network Traffic
modifies: Authentication Log
produces: Authentication
attack-id: T1110.004
definition: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.

Multi-Factor Authentication Interception
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: may-access
  some values from: Security Token
type: NamedIndividual
may-access: Security Token
attack-id: T1111
definition: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.

Modify Registry
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: modifies
  some values from: WindowsRegistry
type: NamedIndividual
modifies: WindowsRegistry
attack-id: T1112
definition: Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.

Screen Capture
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: may-access
  some values from: Display Server
subclass of: Restriction
  on property: may-invoke
  some values from: Get Screen Capture
type: NamedIndividual
may-access: Display Server
may-invoke: Get Screen Capture
definition: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
attack-id: T1113

Email Collection
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: accesses
  some values from: Resource
type: NamedIndividual
accesses: Resource
definition: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
attack-id: T1114

Local Email Collection
type: Class
subclass of: Email Collection
subclass of: Restriction
  on property: reads
  some values from: Email
type: NamedIndividual
reads: Email
attack-id: T1114.001
definition: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

Remote Email Collection
type: Class
subclass of: Email Collection
subclass of: Restriction
  on property: accesses
  some values from: Mail Server
type: NamedIndividual
accesses: Mail Server
attack-id: T1114.002
definition: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.

Email Forwarding Rule
type: Class
subclass of: Email Collection
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration
type: NamedIndividual
modifies: Application Configuration
attack-id: T1114.003
definition: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)

Clipboard Data
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: reads
  some values from: Clipboard
type: NamedIndividual
reads: Clipboard
definition: Adversaries may collect data stored in the clipboard from users copying information within or between applications.
attack-id: T1115

Code Signing
type: Class
subclass of: Defense Evasion Technique
attack-id: T1116
definition: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) However, adversaries are known to use code signing certificates to masquerade malware and tools as legitimate binaries (Citation: Janicab). The certificates used during an operation may be created, forged, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates)
comment: This technique has been revoked by T1553.002
deprecated: true

Regsvr32
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1117
definition: Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)
comment: This technique has been revoked by T1218.010
deprecated: true

InstallUtil
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1118
definition: InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.
comment: This technique has been revoked by T1218.004
deprecated: true

Automated Collection
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: accesses
  some values from: File
type: NamedIndividual
accesses: File
definition: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.
attack-id: T1119

Peripheral Device Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1120
definition: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Regsvcs/Regasm
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1121
definition: Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
comment: This technique has been revoked by T1218.009
deprecated: true

Component Object Model Hijacking
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
attack-id: T1122
definition: The Component Object Model (COM) is a system within Windows to enable interaction between software components through the operating system. (Citation: Microsoft Component Object Model) Adversaries can use this system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Windows Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead. (Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.
comment: This technique has been revoked by T1546.015
deprecated: true

Audio Capture
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: accesses
  some values from: Audio Input Device
type: NamedIndividual
accesses: Audio Input Device
attack-id: T1123
definition: An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.(Citation: ESET Attor Oct 2019)

System Time Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: may-invoke
  some values from: Create Process
subclass of: Restriction
  on property: may-invoke
  some values from: Get System Time
type: NamedIndividual
may-invoke: Create Process
may-invoke: Get System Time
definition: An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)
attack-id: T1124

Video Capture
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: accesses
  some values from: VideoInputDevice
type: NamedIndividual
accesses: VideoInputDevice
definition: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
attack-id: T1125

Network Share Connection Removal
type: Class
subclass of: Defense Evasion Technique
attack-id: T1126
definition: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)
comment: This technique has been revoked by T1070.005
deprecated: true

Trusted Developer Utilities Proxy Execution
type: Class
subclass of: Defense Evasion Technique
attack-id: T1127
definition: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

MSBuild
type: Class
subclass of: Trusted Developer Utilities Proxy Execution
subclass of: Restriction
  on property: modifies
  some values from: Compiler Configuration File
subclass of: Restriction
  on property: runs
  some values from: Compiler
type: NamedIndividual
modifies: Compiler Configuration File
runs: Compiler
definition: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)
attack-id: T1127.001

ClickOnce
type: Class
subclass of: Trusted Developer Utilities Proxy Execution
attack-id: T1127.002
definition: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce)

JamPlus
type: Class
subclass of: Trusted Developer Utilities Proxy Execution
attack-id: T1127.003
definition: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual)

Netsh Helper DLL
type: Class
subclass of: Persistence Technique
attack-id: T1128
definition: Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.
comment: This technique has been revoked by T1546.007
deprecated: true

Shared Modules
type: Class
subclass of: Execution Technique
attack-id: T1129
definition: Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)).

Install Root Certificate
type: Class
subclass of: Defense Evasion Technique
attack-id: T1130
definition: Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
comment: This technique has been revoked by T1553.004
deprecated: true

Authentication Package
type: Class
subclass of: Persistence Technique
attack-id: T1131
definition: Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)
comment: This technique has been revoked by T1547.002
deprecated: true

Data Encoding
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
attack-id: T1132
definition: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.

Standard Encoding
type: Class
subclass of: Data Encoding
attack-id: T1132.001
definition: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.

Non-Standard Encoding
type: Class
subclass of: Data Encoding
attack-id: T1132.002
definition: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding)

External Remote Services
type: Class
subclass of: Initial Access Technique
subclass of: Persistence Technique
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: produces
  some values from: Authorization
subclass of: Restriction
  on property: produces
  some values from: Network Session
type: NamedIndividual
produces: Authentication
produces: Authorization
produces: Network Session
attack-id: T1133
definition: Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop)

Access Token Manipulation
type: Class
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique
attack-id: T1134
definition: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

Token Impersonation/Theft
type: Class
subclass of: Access Token Manipulation
subclass of: Restriction
  on property: copies
  some values from: Access Token
type: NamedIndividual
copies: Access Token
definition: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.
attack-id: T1134.001

Create Process with Token
type: Class
subclass of: Access Token Manipulation
subclass of: Restriction
  on property: copies
  some values from: Access Token
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
type: NamedIndividual
copies: Access Token
may-modify: Event Log
definition: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs)
attack-id: T1134.002

Make and Impersonate Token
type: Class
subclass of: Access Token Manipulation
subclass of: Restriction
  on property: copies
  some values from: Access Token
subclass of: Restriction
  on property: creates
  some values from: Login Session
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
type: NamedIndividual
copies: Access Token
creates: Login Session
may-modify: Event Log
definition: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.
attack-id: T1134.003

Parent PID Spoofing
type: Class
subclass of: Access Token Manipulation
subclass of: Restriction
  on property: invokes
  some values from: Create Process
type: NamedIndividual
invokes: Create Process
definition: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)
attack-id: T1134.004

SID-History Injection
type: Class
subclass of: Access Token Manipulation
subclass of: Restriction
  on property: modifies
  some values from: Access Control Configuration
type: NamedIndividual
modifies: Access Control Configuration
definition: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).
attack-id: T1134.005

Network Share Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1135
definition: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

Create Account
type: Class
subclass of: Persistence Technique
subclass of: Restriction
  on property: creates
  some values from: UserAccount
type: NamedIndividual
creates: UserAccount
definition: Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
attack-id: T1136

Local Account
type: Class
subclass of: Create Account
subclass of: Restriction
  on property: creates
  some values from: Local User Account
type: NamedIndividual
creates: Local User Account
attack-id: T1136.001
definition: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Domain Account
type: Class
subclass of: Create Account
subclass of: Restriction
  on property: creates
  some values from: Domain User Account
type: NamedIndividual
creates: Domain User Account
definition: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)
attack-id: T1136.002

Cloud Account
type: Class
subclass of: Create Account
subclass of: Restriction
  on property: creates
  some values from: Cloud User Account
type: NamedIndividual
creates: Cloud User Account
definition: Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)
attack-id: T1136.003

Office Application Startup
type: Class
subclass of: Persistence Technique
attack-id: T1137
definition: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

Office Template Macros
type: Class
subclass of: Office Application Startup
subclass of: Restriction
  on property: may-add
  some values from: Executable Script
subclass of: Restriction
  on property: may-modify
  some values from: Executable Script
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database Record
type: NamedIndividual
may-add: Executable Script
may-modify: Executable Script
may-modify: System Configuration Database Record
definition: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)
attack-id: T1137.001

Office Test
type: Class
subclass of: Office Application Startup
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record
definition: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)
attack-id: T1137.002

Outlook Forms
type: Class
subclass of: Office Application Startup
subclass of: Restriction
  on property: adds
  some values from: Office Application File
type: NamedIndividual
adds: Office Application File
definition: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)
attack-id: T1137.003

Outlook Home Page
type: Class
subclass of: Office Application Startup
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration Database
type: NamedIndividual
modifies: Application Configuration Database
attack-id: T1137.004
definition: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)

Outlook Rules
type: Class
subclass of: Office Application Startup
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration Database
type: NamedIndividual
modifies: Application Configuration Database
definition: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)
attack-id: T1137.005

Add-ins
type: Class
subclass of: Office Application Startup
subclass of: Restriction
  on property: adds
  some values from: Software
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database
subclass of: Restriction
  on property: modifies
  some values from: Office Application
type: NamedIndividual
adds: Software
may-modify: System Configuration Database
modifies: Office Application
attack-id: T1137.006
definition: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)

Application Shimming
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1138
definition: The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017) Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179) to redirect the code as necessary in order to communicate with the OS.
comment: This technique has been revoked by T1546.011
deprecated: true

Bash History
type: Class
subclass of: Credential Access Technique
attack-id: T1139
definition: Bash keeps track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Attackers can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)
comment: This technique has been revoked by T1552.003
deprecated: true

Deobfuscate/Decode Files or Information
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: may-add
  some values from: Executable File
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
type: NamedIndividual
invokes: Create Process
may-add: Executable File
may-modify: Event Log
attack-id: T1140
definition: Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Input Prompt
type: Class
subclass of: Credential Access Technique
attack-id: T1141
definition: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)).
comment: This technique has been revoked by T1056.002
deprecated: true

Keychain
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: accesses
  some values from: Encrypted Credential
type: NamedIndividual
accesses: Encrypted Credential
attack-id: T1142
definition: Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos. Keychain files are located in ~/Library/Keychains/,/Library/Keychains/, and /Network/Library/Keychains/. (Citation: Wikipedia keychain) The security command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.
deprecated: true
comment: This technique has been revoked by T1555.001

Hidden Window
type: Class
subclass of: Defense Evasion Technique
attack-id: T1143
definition: Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse operating system functionality to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.
comment: This technique has been revoked by T1564.003
deprecated: true

Gatekeeper Bypass
type: Class
subclass of: Defense Evasion Technique
attack-id: T1144
definition: In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called com.apple.quarantine. This attribute is read by Apple's Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution.
comment: This technique has been revoked by T1553.001
deprecated: true

Private Keys
type: Class
subclass of: Credential Access Technique
attack-id: T1145
definition: Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. (Citation: Wikipedia Public Key Crypto)
comment: This technique has been revoked by T1552.004
deprecated: true

Clear Command History
type: Class
subclass of: Defense Evasion Technique
attack-id: T1146
definition: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done. These logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions. Since everything typed on the command-line is saved, passwords passed in on the command line are also saved. Adversaries can abuse this by searching these files for cleartext passwords. Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as unset HISTFILE, export HISTFILESIZE=0, history -c, rm ~/.bash_history.
comment: This technique has been revoked by T1070.003
deprecated: true

Hidden Users
type: Class
subclass of: Defense Evasion Technique
attack-id: T1147
definition: Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account. There is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. By using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 and enabling this property (setting it to Yes), an adversary can hide their user accounts much more easily: sudo dscl . -create /Users/username UniqueID 401 (Citation: Cybereason OSX Pirrit).
comment: This technique has been revoked by T1564.002
deprecated: true

HISTCONTROL
type: Class
subclass of: Defense Evasion Technique
attack-id: T1148
definition: The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.
comment: This technique has been revoked by T1562.003
deprecated: true

LC_MAIN Hijacking
type: Class
subclass of: Defense Evasion Technique
attack-id: T1149
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
deprecated: true

Plist Modification
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1150
definition: Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as /Library/Preferences (which execute with elevated privileges) and ~/Library/Preferences (which execute with a user's privileges).
comment: This technique has been revoked by T1547.011
deprecated: true

Space after Filename
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1151
definition: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to "evil.txt " (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).
comment: This technique has been revoked by T1036.006
deprecated: true

Launchctl
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
subclass of: Persistence Technique
attack-id: T1152
definition: Launchctl controls the macOS launchd process which handles things like launch agents and launch daemons, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. By loading or reloading launch agents or launch daemons, adversaries can install persistence or execute changes they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl is as simple as launchctl submit -l <labelName> -- /Path/to/thing/to/execute "arg" "arg" "arg". Loading, unloading, or reloading launch agents or launch daemons can require elevated privileges.
comment: This technique has been revoked by T1569.001
deprecated: true

Source
type: Class
subclass of: Execution Technique
attack-id: T1153
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
deprecated: true

Trap
type: Class
subclass of: Execution Technique
subclass of: Persistence Technique
attack-id: T1154
definition: The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
comment: This technique has been revoked by T1546.005
deprecated: true

AppleScript
type: Class
subclass of: Execution Technique
attack-id: T1155
definition: macOS and OS X applications send AppleEvent messages to each other for interprocess communications (IPC). These messages can be easily scripted with AppleScript for local or remote IPC. Osascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. A list of OSA languages installed on a system can be found by using the osalang program.
comment: This technique has been revoked by T1059.002
deprecated: true

Malicious Shell Modification
type: Class
subclass of: Persistence Technique
attack-id: T1156
definition: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command line interface or remotely logs in (such as SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
comment: This technique has been revoked by T1546.004
deprecated: true

Dylib Hijacking
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1157
definition: macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence.
comment: This technique has been revoked by T1574.004
deprecated: true

Hidden Files and Directories
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
attack-id: T1158
definition: To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
comment: This technique has been revoked by T1564.001
deprecated: true

Launch Agent
type: Class
subclass of: Persistence Technique
attack-id: T1159
definition: Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in /System/Library/LaunchAgents, /Library/LaunchAgents, and $HOME/Library/LaunchAgents (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).
comment: This technique has been revoked by T1543.001
deprecated: true

Launch Daemon
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1160
definition: Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).
comment: This technique has been revoked by T1543.004
deprecated: true

LC_LOAD_DYLIB Addition
type: Class
subclass of: Persistence Technique
attack-id: T1161
definition: Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long adjustments are made to the rest of the fields and dependencies (Citation: Writing Bad Malware for OSX). There are tools available to perform these changes. Any changes will invalidate digital signatures on binaries because the binary is being modified. Adversaries can remediate this issue by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time (Citation: Malware Persistence on OS X).
comment: This technique has been revoked by T1546.006
deprecated: true

Login Item
type: Class
subclass of: Persistence Technique
attack-id: T1162
definition: MacOS provides the option to list specific applications to run when a user logs in. These applications run under the logged in user's context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them (Citation: Adding Login Items). Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). These login items are stored in the user's ~/Library/Preferences/ directory in a plist file called com.apple.loginitems.plist (Citation: Methods of Mac Malware Persistence). Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to ‘Hide’ the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). The API method SMLoginItemSetEnabled can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1155) can do this as well (Citation: Adding Login Items).
comment: This technique has been revoked by T1547.011
deprecated: true

Rc.common
type: Class
subclass of: Persistence Technique
attack-id: T1163
definition: During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.
comment: This technique has been revoked by T1037.004
deprecated: true

Re-opened Applications
type: Class
subclass of: Persistence Technique
attack-id: T1164
definition: Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist.
comment: This technique has been revoked by T1547.007
deprecated: true

Startup Items
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1165
definition: Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items). This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.
comment: This technique has been revoked by T1037.005
deprecated: true

Setuid and Setgid
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1166
definition: When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file].
comment: This technique has been revoked by T1548.001
deprecated: true

Securityd Memory
type: Class
subclass of: Credential Access Technique
attack-id: T1167
definition: In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. (Citation: OS X Keychain) (Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password. (Citation: OS X Keychain)
comment: This technique has been revoked by T1555.002
deprecated: true

Local Job Scheduling
type: Class
subclass of: Execution Technique
subclass of: Persistence Technique
attack-id: T1168
definition: On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).
comment: This technique has been revoked by T1053
deprecated: true

Sudo
type: Class
subclass of: Privilege Escalation Technique
attack-id: T1169
definition: The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL (Citation: OSX.Dok Malware).
comment: This technique has been revoked by T1548.003
deprecated: true

Mshta
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1170
definition: Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension .hta. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)
comment: This technique has been revoked by T1218.005
deprecated: true

LLMNR/NBT-NS Poisoning and Relay
type: Class
subclass of: Credential Access Technique
attack-id: T1171
definition: Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)
comment: This technique has been revoked by T1557.001
deprecated: true

Domain Fronting
type: Class
subclass of: Command and Control Technique
attack-id: T1172
definition: Domain fronting takes advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) The technique involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).
comment: This technique has been revoked by T1090.004
deprecated: true

Dynamic Data Exchange
type: Class
subclass of: Execution Technique
attack-id: T1173
definition: Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
comment: This technique has been revoked by T1559.002
deprecated: true

Password Filter DLL
type: Class
subclass of: Credential Access Technique
attack-id: T1174
definition: Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.
comment: This technique has been revoked by T1556.002
deprecated: true

Component Object Model and Distributed COM
type: Class
subclass of: Execution Technique
subclass of: Lateral Movement Technique
attack-id: T1175
definition: **This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**
comment: **This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**
deprecated: true

Software Extensions
type: Class
subclass of: Persistence Technique
subclass of: Restriction
  on property: modifies
  some values from: Browser Extension
type: NamedIndividual
modifies: Browser Extension
attack-id: T1176
definition: Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)

Browser Extensions
type: Class
subclass of: Software Extensions
attack-id: T1176.001
definition: Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)

IDE Extensions
type: Class
subclass of: Software Extensions
attack-id: T1176.002
definition: Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.(Citation: Mnemonic misuse visual studio) IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker. A malicious extension can be installed through an extension marketplace (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)) or side-loaded directly into the IDE.(Citation: Abramovsky VSCode Security)(Citation: Lakshmanan Visual Studio Marketplace)

LSASS Driver
type: Class
subclass of: Execution Technique
subclass of: Persistence Technique
attack-id: T1177
definition: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)
comment: This technique has been revoked by T1547.008
deprecated: true

SID-History Injection
type: Class
subclass of: Privilege Escalation Technique
attack-id: T1178
definition: The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).
comment: This technique has been revoked by T1134.005
deprecated: true

Hooking
type: Class
subclass of: Credential Access Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1179
definition: Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions.
comment: This technique has been revoked by T1056.004
deprecated: true

Screensaver
type: Class
subclass of: Persistence Technique
attack-id: T1180
definition: Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
comment: This technique has been revoked by T1546.002
deprecated: true

Extra Window Memory Injection
type: Class
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique
attack-id: T1181
definition: Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data). (Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of extra window memory (EWM) to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)
comment: This technique has been revoked by T1055.011
deprecated: true

AppCert DLLs
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1182
definition: Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)
comment: This technique has been revoked by T1546.009
deprecated: true

Image File Execution Options Injection
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1183
definition: Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)
comment: This technique has been revoked by T1546.012
deprecated: true

SSH Hijacking
type: Class
subclass of: Lateral Movement Technique
attack-id: T1184
definition: Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.
comment: This technique has been revoked by T1563.001
deprecated: true

Browser Session Hijacking
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: produces
  some values from: WebNetworkTraffic
type: NamedIndividual
produces: WebNetworkTraffic
definition: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.(Citation: Wikipedia Man in the Browser)
attack-id: T1185

Process Doppelgänging
type: Class
subclass of: Defense Evasion Technique
attack-id: T1186
definition: Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)
comment: This technique has been revoked by T1055.013
deprecated: true

Forced Authentication
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: may-modify
  some values from: WindowsShortcutFile
subclass of: Restriction
  on property: modifies
  some values from: Authentication Log
subclass of: Restriction
  on property: produces
  some values from: Authentication
type: NamedIndividual
may-modify: WindowsShortcutFile
modifies: Authentication Log
produces: Authentication
attack-id: T1187
definition: Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Multi-hop Proxy
type: Class
subclass of: Command and Control Technique
attack-id: T1188
definition: To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
comment: This technique has been revoked by T1090.003
deprecated: true

Drive-by Compromise
type: Class
subclass of: Initial Access Technique
subclass of: Restriction
  on property: modifies
  some values from: Process Segment
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: URL
type: NamedIndividual
modifies: Process Segment
produces: Outbound Internet Network Traffic
produces: URL
attack-id: T1189
definition: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring [Application Access Token](https://attack.mitre.org/techniques/T1550/001).

Exploit Public-Facing Application
type: Class
subclass of: Initial Access Technique
subclass of: Restriction
  on property: injects
  some values from: Database Query
subclass of: Restriction
  on property: modifies
  some values from: Process Segment
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Network Traffic
type: NamedIndividual
injects: Database Query
modifies: Process Segment
produces: Inbound Internet Network Traffic
definition: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
attack-id: T1190

CMSTP
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1191
definition: The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
comment: This technique has been revoked by T1218.003
deprecated: true

Spearphishing Link
type: Class
subclass of: Initial Access Technique
attack-id: T1192
definition: Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
comment: This technique has been revoked by T1566.002
deprecated: true

Spearphishing Attachment
type: Class
subclass of: Initial Access Technique
attack-id: T1193
definition: Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.
comment: This technique has been revoked by T1566.001
deprecated: true

Spearphishing via Service
type: Class
subclass of: Initial Access Technique
attack-id: T1194
definition: Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
comment: This technique has been revoked by T1566.003
deprecated: true

Supply Chain Compromise
type: Class
subclass of: Initial Access Technique
subclass of: Restriction
  on property: modifies
  some values from: Digital Artifact
type: NamedIndividual
modifies: Digital Artifact
definition: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
attack-id: T1195

Compromise Software Dependencies and Development Tools
type: Class
subclass of: Supply Chain Compromise
subclass of: Restriction
  on property: modifies
  some values from: Software
type: NamedIndividual
modifies: Software
attack-id: T1195.001
definition: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)

Compromise Software Supply Chain
type: Class
subclass of: Supply Chain Compromise
subclass of: Restriction
  on property: modifies
  some values from: Software
type: NamedIndividual
modifies: Software
attack-id: T1195.002
definition: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Compromise Hardware Supply Chain
type: Class
subclass of: Supply Chain Compromise
subclass of: Restriction
  on property: modifies
  some values from: Hardware Device
type: NamedIndividual
modifies: Hardware Device
attack-id: T1195.003
definition: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.

Control Panel Items
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1196
definition: Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)
comment: This technique has been revoked by T1218.002
deprecated: true

BITS Jobs
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
subclass of: Restriction
  on property: may-produce
  some values from: Intranet IPC Network Traffic
subclass of: Restriction
  on property: may-produce
  some values from: Intranet Web Network Traffic
subclass of: Restriction
  on property: may-produce
  some values from: Outbound Internet Web Traffic
type: NamedIndividual
may-produce: Intranet IPC Network Traffic
may-produce: Intranet Web Network Traffic
may-produce: Outbound Internet Web Traffic
attack-id: T1197
definition: Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.

SIP and Trust Provider Hijacking
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
attack-id: T1198
definition: In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)
comment: This technique has been revoked by T1553.003
deprecated: true

Trusted Relationship
type: Class
subclass of: Initial Access Technique
subclass of: Restriction
  on property: creates
  some values from: Login Session
subclass of: Restriction
  on property: produces
  some values from: Intranet Network Traffic
type: NamedIndividual
creates: Login Session
produces: Intranet Network Traffic
attack-id: T1199
definition: Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Hardware Additions
type: Class
subclass of: Initial Access Technique
subclass of: Restriction
  on property: connects
  some values from: Hardware Device
type: NamedIndividual
connects: Hardware Device
attack-id: T1200
definition: Adversaries may introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.

Password Policy Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1201
definition: Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Indirect Command Execution
type: Class
subclass of: Defense Evasion Technique
attack-id: T1202
definition: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)

Exploitation for Client Execution
type: Class
subclass of: Execution Technique
subclass of: Restriction
  on property: modifies
  some values from: Process Code Segment
subclass of: Restriction
  on property: modifies
  some values from: Stack Frame
type: NamedIndividual
modifies: Process Code Segment
modifies: Stack Frame
attack-id: T1203
definition: Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

User Execution
type: Class
subclass of: Execution Technique
attack-id: T1204
definition: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).

Malicious Link
type: Class
subclass of: User Execution
subclass of: Restriction
  on property: accesses
  some values from: URL
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Web Traffic
type: NamedIndividual
accesses: URL
produces: Outbound Internet Web Traffic
attack-id: T1204.001
definition: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).

Malicious File
type: Class
subclass of: User Execution
subclass of: Restriction
  on property: executes
  some values from: Executable File
type: NamedIndividual
executes: Executable File
definition: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
attack-id: T1204.002

Malicious Image
type: Class
subclass of: User Execution
attack-id: T1204.003
definition: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)

Malicious Copy and Paste
type: Class
subclass of: User Execution
attack-id: T1204.004
definition: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).

Traffic Signaling
type: Class
subclass of: Command and Control Technique
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
type: NamedIndividual
produces: Network Traffic
definition: Adversaries use traffic signaling techniques, such as sending specific network sequences or magic packets, to covertly trigger actions like opening ports, activating backdoors, or installing filters, facilitating command and control, persistence, and defense evasion.
attack-id: T1205

Port Knocking
type: Class
subclass of: Traffic Signaling
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
type: NamedIndividual
produces: Network Traffic
definition: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.
attack-id: T1205.001

Socket Filters
type: Class
subclass of: Traffic Signaling
attack-id: T1205.002
definition: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell.

Sudo Caching
type: Class
subclass of: Privilege Escalation Technique
attack-id: T1206
definition: The sudo command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments." (Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout that is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).
comment: This technique has been revoked by T1548.003
deprecated: true

Rogue Domain Controller
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database
subclass of: Restriction
  on property: produces
  some values from: Intranet Administrative Network Traffic
type: NamedIndividual
modifies: System Configuration Database
produces: Intranet Administrative Network Traffic
definition: Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.
attack-id: T1207

Kerberoasting
type: Class
subclass of: Credential Access Technique
attack-id: T1208
definition: Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service (Citation: Microsoft Detecting Kerberoasting Feb 2018)). (Citation: Microsoft SPN) (Citation: Microsoft SetSPN) (Citation: SANS Attacking Kerberos Nov 2014) (Citation: Harmj0y Kerberoast Nov 2016)
comment: This technique has been revoked by T1558.003
deprecated: true

Time Providers
type: Class
subclass of: Persistence Technique
attack-id: T1209
definition: The Windows Time service (W32Time) enables time synchronization across and within domains. (Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. (Citation: Microsoft TimeProvider)
comment: This technique has been revoked by T1547.003
deprecated: true

Exploitation of Remote Services
type: Class
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: may-modify
  some values from: Process Code Segment
subclass of: Restriction
  on property: may-modify
  some values from: Process Segment
subclass of: Restriction
  on property: may-modify
  some values from: Stack Frame
subclass of: Restriction
  on property: produces
  some values from: Intranet Network Traffic
type: NamedIndividual
may-modify: Process Code Segment
may-modify: Process Segment
may-modify: Stack Frame
produces: Intranet Network Traffic
attack-id: T1210
definition: Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Exploitation for Defense Evasion
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: may-modify
  some values from: Process Code Segment
subclass of: Restriction
  on property: may-modify
  some values from: Stack Frame
type: NamedIndividual
may-modify: Process Code Segment
may-modify: Stack Frame
attack-id: T1211
definition: Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.

Exploitation for Credential Access
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: may-access
  some values from: Authentication Service
subclass of: Restriction
  on property: may-access
  some values from: Credential Management System
subclass of: Restriction
  on property: may-modify
  some values from: Process Code Segment
subclass of: Restriction
  on property: may-modify
  some values from: Stack Frame
type: NamedIndividual
may-access: Authentication Service
may-access: Credential Management System
may-modify: Process Code Segment
may-modify: Stack Frame
definition: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.
attack-id: T1212

Data from Information Repositories
type: Class
subclass of: Collection Technique
subclass of: Discovery Technique
subclass of: Restriction
  on property: accesses
  some values from: Resource
type: NamedIndividual
accesses: Resource
definition: Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.
attack-id: T1213

Confluence
type: Class
subclass of: Data from Information Repositories
subclass of: Restriction
  on property: accesses
  some values from: WebFileResource
type: NamedIndividual
accesses: WebFileResource
attack-id: T1213.001

Sharepoint
type: Class
subclass of: Data from Information Repositories
subclass of: Restriction
  on property: accesses
  some values from: WebFileResource
type: NamedIndividual
accesses: WebFileResource
attack-id: T1213.002
definition: Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

Code Repositories
type: Class
subclass of: Data from Information Repositories
subclass of: Restriction
  on property: reads
  some values from: Code Repository
type: NamedIndividual
reads: Code Repository
attack-id: T1213.003
definition: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

Customer Relationship Management Software
type: Class
subclass of: Data from Information Repositories
attack-id: T1213.004
definition: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data.

Messaging Applications
type: Class
subclass of: Data from Information Repositories
attack-id: T1213.005
definition: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.

Credentials in Registry
type: Class
subclass of: Credential Access Technique
attack-id: T1214
definition: The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
comment: This technique has been revoked by T1552.002
deprecated: true

Kernel Modules and Extensions
type: Class
subclass of: Persistence Technique
attack-id: T1215
definition: Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)
comment: This technique has been revoked by T1547.006
deprecated: true

System Script Proxy Execution
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1216
definition: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)

PubPrn
type: Class
subclass of: System Script Proxy Execution
attack-id: T1216.001
definition: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.(Citation: pubprn)

SyncAppvPublishingServer
type: Class
subclass of: System Script Proxy Execution
attack-id: T1216.002
definition: Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv)

Browser Information Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1217
definition: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill)

System Binary Proxy Execution
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1218
definition: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Compiled HTML File
type: Class
subclass of: System Binary Proxy Execution
subclass of: Restriction
  on property: invokes
  some values from: Create File
subclass of: Restriction
  on property: invokes
  some values from: Create Process
type: NamedIndividual
invokes: Create File
invokes: Create Process
definition: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)
attack-id: T1218.001

Control Panel
type: Class
subclass of: System Binary Proxy Execution
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database Record
type: NamedIndividual
invokes: Create Process
may-modify: System Configuration Database Record
attack-id: T1218.002
definition: Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

CMSTP
type: Class
subclass of: System Binary Proxy Execution
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: may-produce
  some values from: Network Traffic
type: NamedIndividual
invokes: Create Process
may-produce: Network Traffic
attack-id: T1218.003
definition: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

InstallUtil
type: Class
subclass of: System Binary Proxy Execution
attack-id: T1218.004
definition: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe.

Mshta
type: Class
subclass of: System Binary Proxy Execution
subclass of: Restriction
  on property: interprets
  some values from: Microsoft HTML Application
subclass of: Restriction
  on property: invokes
  some values from: Create Process
type: NamedIndividual
interprets: Microsoft HTML Application
invokes: Create Process
attack-id: T1218.005
definition: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)

Msiexec
type: Class
subclass of: System Binary Proxy Execution
attack-id: T1218.007
definition: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft.

Odbcconf
type: Class
subclass of: System Binary Proxy Execution
attack-id: T1218.008
definition: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.

Regsvcs/Regasm
type: Class
subclass of: System Binary Proxy Execution
attack-id: T1218.009
definition: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)

Regsvr32
type: Class
subclass of: System Binary Proxy Execution
attack-id: T1218.010
definition: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. (Citation: Microsoft Regsvr32)

Rundll32
type: Class
subclass of: System Binary Proxy Execution
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: loads
  some values from: Shared Library File
type: NamedIndividual
invokes: Create Process
loads: Shared Library File
definition: Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).
attack-id: T1218.011

Verclsid
type: Class
subclass of: System Binary Proxy Execution
attack-id: T1218.012
definition: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe)

Mavinject
type: Class
subclass of: System Binary Proxy Execution
subclass of: Restriction
  on property: invokes
  some values from: Create Thread
subclass of: Restriction
  on property: modifies
  some values from: Process Segment
type: NamedIndividual
invokes: Create Thread
modifies: Process Segment
definition: Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject)
attack-id: T1218.013

MMC
type: Class
subclass of: System Binary Proxy Execution
subclass of: Restriction
  on property: executes
  some values from: Command
subclass of: Restriction
  on property: may-add
  some values from: Software
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database
type: NamedIndividual
executes: Command
may-add: Software
may-modify: System Configuration Database
attack-id: T1218.014
definition: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt.(Citation: win_mmc)(Citation: what_is_mmc) MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration.(Citation: win_msc_files_overview)

Electron Applications
type: Class
subclass of: System Binary Proxy Execution
attack-id: T1218.015
definition: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1)

Remote Access Tools
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
definition: An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)
attack-id: T1219

IDE Tunneling
type: Class
subclass of: Remote Access Tools
attack-id: T1219.001
definition: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023)

Remote Desktop Software
type: Class
subclass of: Remote Access Tools
attack-id: T1219.002
definition: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)

Remote Access Hardware
type: Class
subclass of: Remote Access Tools
attack-id: T1219.003
definition: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment.

XSL Script Processing
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: adds
  some values from: File
subclass of: Restriction
  on property: interprets
  some values from: Executable Script
subclass of: Restriction
  on property: invokes
  some values from: Create Process
type: NamedIndividual
adds: File
interprets: Executable Script
invokes: Create Process
definition: Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)
attack-id: T1220

Template Injection
type: Class
subclass of: Defense Evasion Technique
attack-id: T1221
definition: Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)

File and Directory Permissions Modification
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: modifies
  some values from: Access Control Configuration
type: NamedIndividual
modifies: Access Control Configuration
definition: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
attack-id: T1222

Windows File and Directory Permissions Modification
type: Class
subclass of: File and Directory Permissions Modification
attack-id: T1222.001
definition: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Linux and Mac File and Directory Permissions Modification
type: Class
subclass of: File and Directory Permissions Modification
attack-id: T1222.002
definition: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Compiled HTML File
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1223
definition: Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)
comment: This technique has been revoked by T1218.001
deprecated: true

Execution Guardrails
type: Class
subclass of: Defense Evasion Technique
attack-id: T1480
definition: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)

Environmental Keying
type: Class
subclass of: Execution Guardrails
attack-id: T1480.001
definition: Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)

Mutual Exclusion
type: Class
subclass of: Execution Guardrails
attack-id: T1480.002
definition: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes)

Domain Trust Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1482
definition: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)

Domain Generation Algorithms
type: Class
subclass of: Command and Control Technique
attack-id: T1483
definition: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)
comment: This technique has been revoked by T1568.002
deprecated: true

Domain or Tenant Policy Modification
type: Class
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique
subclass of: Restriction
  on property: modifies
  some values from: Group Policy
type: NamedIndividual
modifies: Group Policy
attack-id: T1484
definition: Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation.

Group Policy Modification
type: Class
subclass of: Domain or Tenant Policy Modification
attack-id: T1484.001
definition: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)

Trust Modification
type: Class
subclass of: Domain or Tenant Policy Modification
attack-id: T1484.002
definition: Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.

Data Destruction
type: Class
subclass of: Impact Technique
attack-id: T1485
definition: Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Lifecycle-Triggered Deletion
type: Class
subclass of: Data Destruction
attack-id: T1485.001
definition: Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

Data Encrypted for Impact
type: Class
subclass of: Impact Technique
attack-id: T1486
definition: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)

Disk Structure Wipe
type: Class
subclass of: Impact Technique
attack-id: T1487
definition: Adversaries may corrupt or wipe the disk data structures on hard drive necessary to boot systems; targeting specific critical systems as well as a large number of systems in a network to interrupt availability to system and network resources.
comment: This technique has been revoked by T1561.002
deprecated: true

Disk Content Wipe
type: Class
subclass of: Impact Technique
attack-id: T1488
definition: Adversaries may erase the contents of storage devices on specific systems as well as large numbers of systems in a network to interrupt availability to system and network resources.
comment: This technique has been revoked by T1561.001
deprecated: true

Service Stop
type: Class
subclass of: Impact Technique
attack-id: T1489
definition: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)

Inhibit System Recovery
type: Class
subclass of: Impact Technique
attack-id: T1490
definition: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.

Defacement
type: Class
subclass of: Impact Technique
attack-id: T1491
definition: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.

Internal Defacement
type: Class
subclass of: Defacement
subclass of: Restriction
  on property: modifies
  some values from: Resource
type: NamedIndividual
modifies: Resource
attack-id: T1491.001
definition: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)

External Defacement
type: Class
subclass of: Defacement
subclass of: Restriction
  on property: modifies
  some values from: Network Resource
type: NamedIndividual
modifies: Network Resource
attack-id: T1491.002
definition: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)

Stored Data Manipulation
type: Class
subclass of: Impact Technique
attack-id: T1492
definition: Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
comment: This technique has been revoked by T1565.001
deprecated: true

Transmitted Data Manipulation
type: Class
subclass of: Impact Technique
attack-id: T1493
definition: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
comment: This technique has been revoked by T1565.002
deprecated: true

Runtime Data Manipulation
type: Class
subclass of: Impact Technique
attack-id: T1494
definition: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
comment: This technique has been revoked by T1565.003
deprecated: true

Firmware Corruption
type: Class
subclass of: Impact Technique
attack-id: T1495
definition: Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.

Resource Hijacking
type: Class
subclass of: Impact Technique
attack-id: T1496
definition: Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Compute Hijacking
type: Class
subclass of: Resource Hijacking
attack-id: T1496.001
definition: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Bandwidth Hijacking
type: Class
subclass of: Resource Hijacking
attack-id: T1496.002
definition: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

SMS Pumping
type: Class
subclass of: Resource Hijacking
attack-id: T1496.003
definition: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud)

Cloud Service Hijacking
type: Class
subclass of: Resource Hijacking
attack-id: T1496.004
definition: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.

Virtualization/Sandbox Evasion
type: Class
subclass of: Defense Evasion Technique
attack-id: T1497
definition: Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

System Checks
type: Class
subclass of: Virtualization/Sandbox Evasion
attack-id: T1497.001
definition: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

User Activity Based Checks
type: Class
subclass of: Virtualization/Sandbox Evasion
attack-id: T1497.002
definition: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Time Based Evasion
type: Class
subclass of: Virtualization/Sandbox Evasion
subclass of: Restriction
  on property: may-invoke
  some values from: Get System Time
subclass of: Restriction
  on property: may-run
  some values from: System Time Application
type: NamedIndividual
may-invoke: Get System Time
may-run: System Time Application
attack-id: T1497.003
definition: Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.

Network Denial of Service
type: Class
subclass of: Impact Technique
attack-id: T1498
definition: Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

Direct Network Flood
type: Class
subclass of: Network Denial of Service
subclass of: Restriction
  on property: creates
  some values from: Inbound Internet Network Traffic
type: NamedIndividual
creates: Inbound Internet Network Traffic
definition: Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001)s are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.
attack-id: T1498.001

Reflection Amplification
type: Class
subclass of: Network Denial of Service
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Network Traffic
type: NamedIndividual
produces: Inbound Internet Network Traffic
definition: Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflectors may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017) This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network.
attack-id: T1498.002

Endpoint Denial of Service
type: Class
subclass of: Impact Technique
attack-id: T1499
definition: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

OS Exhaustion Flood
type: Class
subclass of: Endpoint Denial of Service
attack-id: T1499.001
definition: Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes.

Service Exhaustion Flood
type: Class
subclass of: Network Denial of Service
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Network Traffic
type: NamedIndividual
produces: Inbound Internet Network Traffic
attack-id: T1499.002
definition: Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.

Application Exhaustion Flood
type: Class
subclass of: Endpoint Denial of Service
attack-id: T1499.003
definition: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)

Application or System Exploitation
type: Class
subclass of: Endpoint Denial of Service
attack-id: T1499.004
definition: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Compile After Delivery
type: Class
subclass of: Defense Evasion Technique
attack-id: T1500
definition: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)
comment: This technique has been revoked by T1027.004
deprecated: true

Systemd Service
type: Class
subclass of: Persistence Technique
attack-id: T1501
definition: Systemd services can be used to establish persistence on a Linux system. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
comment: This technique has been revoked by T1543.002
deprecated: true

Parent PID Spoofing
type: Class
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique
attack-id: T1502
definition: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)
comment: This technique has been revoked by T1134.004
deprecated: true

Credentials from Web Browsers
type: Class
subclass of: Credential Access Technique
attack-id: T1503
definition: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (Citation: Talos Olympic Destroyer 2018)
comment: This technique has been revoked by T1555.003
deprecated: true

PowerShell Profile
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1504
definition: Adversaries may gain persistence and elevate privileges in certain situations by abusing [PowerShell](https://attack.mitre.org/techniques/T1086) profiles. A PowerShell profile (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. PowerShell supports several profiles depending on the user or host program. For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles)
comment: This technique has been revoked by T1546.013
deprecated: true

Server Software Component
type: Class
subclass of: Persistence Technique
attack-id: T1505
definition: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)

SQL Stored Procedures
type: Class
subclass of: Server Software Component
subclass of: Restriction
  on property: creates
  some values from: Stored Procedure
subclass of: Restriction
  on property: invokes
  some values from: Create Process
type: NamedIndividual
creates: Stored Procedure
invokes: Create Process
definition: Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).
attack-id: T1505.001

Transport Agent
type: Class
subclass of: Server Software Component
subclass of: Restriction
  on property: adds
  some values from: Message Transfer Agent
subclass of: Restriction
  on property: modifies
  some values from: Mail Server
type: NamedIndividual
adds: Message Transfer Agent
modifies: Mail Server
attack-id: T1505.002
definition: Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.

Web Shell
type: Class
subclass of: Server Software Component
subclass of: Restriction
  on property: adds
  some values from: WebScriptFile
subclass of: Restriction
  on property: modifies
  some values from: WebServer
subclass of: Restriction
  on property: produces
  some values from: Process
type: NamedIndividual
adds: WebScriptFile
modifies: WebServer
produces: Process
attack-id: T1505.003
definition: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)

IIS Components
type: Class
subclass of: Server Software Component
subclass of: Restriction
  on property: adds
  some values from: Software
type: NamedIndividual
adds: Software
attack-id: T1505.004
definition: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation: Trustwave IIS Module 2013)

Terminal Services DLL
type: Class
subclass of: Server Software Component
attack-id: T1505.005
definition: Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services)

vSphere Installation Bundles
type: Class
subclass of: Server Software Component
attack-id: T1505.006
definition: Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments. Since ESXi uses an in-memory filesystem where changes made to most files are stored in RAM rather than in persistent storage, these modifications are lost after a reboot. However, VIBs can be used to create startup tasks, apply custom firewall rules, or deploy binaries that persist across reboots. Typically, administrators use VIBs for updates and system maintenance.

Web Session Cookie
type: Class
subclass of: Defense Evasion Technique
subclass of: Lateral Movement Technique
attack-id: T1506
definition: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)
comment: This technique has been revoked by T1550.004
deprecated: true

Elevated Execution with Prompt
type: Class
subclass of: Privilege Escalation Technique
attack-id: T1514
definition: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.
comment: This technique has been revoked by T1548.004
deprecated: true

Software Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1518
definition: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Security Software Discovery
type: Class
subclass of: Software Discovery
subclass of: Restriction
  on property: may-access
  some values from: File System Metadata
subclass of: Restriction
  on property: may-access
  some values from: Kernel Process Table
subclass of: Restriction
  on property: may-access
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: may-access
  some values from: System Firewall Configuration
subclass of: Restriction
  on property: may-invoke
  some values from: Get Running Processes
type: NamedIndividual
may-access: File System Metadata
may-access: Kernel Process Table
may-access: System Configuration Database Record
may-access: System Firewall Configuration
may-invoke: Get Running Processes
attack-id: T1518.001
definition: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Emond
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1519
definition: Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)
comment: This technique has been revoked by T1546.014
deprecated: true

Cloud Instance Metadata API
type: Class
subclass of: Credential Access Technique
attack-id: T1522
definition: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
comment: This technique has been revoked by T1552.005
deprecated: true

Implant Internal Image
type: Class
subclass of: Persistence Technique
subclass of: Restriction
  on property: adds
  some values from: Container Image
type: NamedIndividual
adds: Container Image
definition: Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike [Upload Malware](https://attack.mitre.org/techniques/T1608/001), this technique focuses on adversaries implanting an image in a registry within a victim’s environment. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)
attack-id: T1525

Cloud Service Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: reads
  some values from: Cloud Configuration
type: NamedIndividual
reads: Cloud Configuration
definition: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
attack-id: T1526

Application Access Token
type: Class
subclass of: Defense Evasion Technique
subclass of: Lateral Movement Technique
attack-id: T1527
definition: Adversaries may use application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.
comment: This technique has been revoked by T1550.001
deprecated: true

Steal Application Access Token
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: accesses
  some values from: Access Token
type: NamedIndividual
accesses: Access Token
attack-id: T1528
definition: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

System Shutdown/Reboot
type: Class
subclass of: Impact Technique
attack-id: T1529
definition: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A)

Data from Cloud Storage
type: Class
subclass of: Collection Technique
attack-id: T1530
definition: Adversaries may access data from cloud storage.

Account Access Removal
type: Class
subclass of: Impact Technique
subclass of: Restriction
  on property: modifies
  some values from: UserAccount
type: NamedIndividual
modifies: UserAccount
definition: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)
attack-id: T1531

Internal Spearphishing
type: Class
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: produces
  some values from: Email
type: NamedIndividual
produces: Email
definition: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating [Impersonation](https://attack.mitre.org/techniques/T1656).(Citation: Trend Micro - Int SP)
attack-id: T1534

Unused/Unsupported Cloud Regions
type: Class
subclass of: Defense Evasion Technique
attack-id: T1535
definition: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.

Revert Cloud Instance
type: Class
subclass of: Defense Evasion Technique
attack-id: T1536
definition: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.
comment: This technique has been revoked by T1578.004
deprecated: true

Transfer Data to Cloud Account
type: Class
subclass of: Exfiltration Technique
attack-id: T1537
definition: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

Cloud Service Dashboard
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: accesses
  some values from: Cloud Configuration
type: NamedIndividual
accesses: Cloud Configuration
attack-id: T1538
definition: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)

Steal Web Session Cookie
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: accesses
  some values from: Session Cookie
type: NamedIndividual
accesses: Session Cookie
definition: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
attack-id: T1539

Pre-OS Boot
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
attack-id: T1542
definition: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)

System Firmware
type: Class
subclass of: Pre-OS Boot
subclass of: Restriction
  on property: modifies
  some values from: System Firmware
type: NamedIndividual
modifies: System Firmware
attack-id: T1542.001
definition: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI)

Component Firmware
type: Class
subclass of: Pre-OS Boot
subclass of: Restriction
  on property: modifies
  some values from: Firmware
type: NamedIndividual
modifies: Firmware
definition: Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking.
attack-id: T1542.002

Bootkit
type: Class
subclass of: Pre-OS Boot
subclass of: Restriction
  on property: may-modify
  some values from: Boot Loader
subclass of: Restriction
  on property: may-modify
  some values from: Boot Sector
subclass of: Restriction
  on property: may-modify
  some values from: VolumeBootRecord
type: NamedIndividual
may-modify: Boot Loader
may-modify: Boot Sector
may-modify: VolumeBootRecord
attack-id: T1542.003
definition: Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

ROMMONkit
type: Class
subclass of: Pre-OS Boot
subclass of: Restriction
  on property: modifies
  some values from: System Firmware
type: NamedIndividual
modifies: System Firmware
definition: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)
attack-id: T1542.004

TFTP Boot
type: Class
subclass of: Pre-OS Boot
subclass of: Restriction
  on property: creates
  some values from: TFTP Network Traffic
type: NamedIndividual
creates: TFTP Network Traffic
attack-id: T1542.005
definition: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.

Create or Modify System Process
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1543
definition: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons)

Launch Agent
type: Class
subclass of: Create or Modify System Process
subclass of: Restriction
  on property: creates
  some values from: Property List File
type: NamedIndividual
creates: Property List File
definition: Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
attack-id: T1543.001

Systemd Service
type: Class
subclass of: Create or Modify System Process
subclass of: Restriction
  on property: may-create
  some values from: Operating System Configuration File
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Configuration File
type: NamedIndividual
may-create: Operating System Configuration File
may-modify: Operating System Configuration File
definition: Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014) Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
attack-id: T1543.002

Windows Service
type: Class
subclass of: Create or Modify System Process
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database
type: NamedIndividual
modifies: System Configuration Database
attack-id: T1543.003
definition: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Launch Daemon
type: Class
subclass of: Create or Modify System Process
subclass of: Restriction
  on property: modifies
  some values from: Property List File
type: NamedIndividual
modifies: Property List File
attack-id: T1543.004
definition: Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.(Citation: AppleDocs Launch Agent Daemons)(Citation: Methods of Mac Malware Persistence)(Citation: launchd Keywords for plists)

Container Service
type: Class
subclass of: Create or Modify System Process
attack-id: T1543.005
definition: Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their privileges on a host.

Event Triggered Execution
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1546
definition: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)

Change Default File Association
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record
definition: Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.(Citation: Microsoft Change Default Programs)(Citation: Microsoft File Handlers)(Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
attack-id: T1546.001

Screensaver
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: creates
  some values from: Executable File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
creates: Executable File
modifies: System Configuration Database Record
attack-id: T1546.002
definition: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.

Windows Management Instrumentation Event Subscription
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: modifies
  some values from: Event Log
subclass of: Restriction
  on property: produces
  some values from: Intranet Administrative Network Traffic
type: NamedIndividual
modifies: Event Log
produces: Intranet Administrative Network Traffic
definition: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015)
attack-id: T1546.003

Unix Shell Configuration Modification
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: modifies
  some values from: UserInitConfigurationFile
type: NamedIndividual
modifies: UserInitConfigurationFile
definition: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
attack-id: T1546.004

Trap
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: executes
  some values from: Command
subclass of: Restriction
  on property: may-create
  some values from: Executable Script
subclass of: Restriction
  on property: may-modify
  some values from: Executable Script
subclass of: Restriction
  on property: modifies
  some values from: Event Log
type: NamedIndividual
executes: Command
may-create: Executable Script
may-modify: Executable Script
modifies: Event Log
definition: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.
attack-id: T1546.005

LC_LOAD_DYLIB Addition
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: modifies
  some values from: Executable Binary
type: NamedIndividual
modifies: Executable Binary
definition: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) There are tools available to perform these changes.
attack-id: T1546.006

Netsh Helper DLL
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: produces
  some values from: Process
type: NamedIndividual
modifies: System Configuration Database Record
produces: Process
attack-id: T1546.007
definition: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.

Accessibility Features
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: may-create
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: may-modify
  some values from: Executable Binary
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database Record
type: NamedIndividual
may-create: Intranet Administrative Network Traffic
may-modify: Executable Binary
may-modify: System Configuration Database Record
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
attack-id: T1546.008

AppCert DLLs
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: loads
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
invokes: Create Process
loads: Shared Library File
modifies: System Configuration Database Record
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)
attack-id: T1546.009

AppInit DLLs
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: loads
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
invokes: Create Process
loads: Shared Library File
modifies: System Configuration Database Record
attack-id: T1546.010
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017)

Application Shimming
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: creates
  some values from: Shim
subclass of: Restriction
  on property: modifies
  some values from: Shim Database
type: NamedIndividual
creates: Shim
modifies: Shim Database
attack-id: T1546.011
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017)

Image File Execution Options Injection
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database
type: NamedIndividual
modifies: System Configuration Database
attack-id: T1546.012
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., C:\dbg\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)

PowerShell Profile
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: modifies
  some values from: PowerShell Profile Script
type: NamedIndividual
modifies: PowerShell Profile Script
definition: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.
attack-id: T1546.013

Emond
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: may-create
  some values from: Property List File
subclass of: Restriction
  on property: may-modify
  some values from: Property List File
subclass of: Restriction
  on property: modifies
  some values from: Configuration Resource
type: NamedIndividual
may-create: Property List File
may-modify: Property List File
modifies: Configuration Resource
definition: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.
attack-id: T1546.014

Component Object Model Hijacking
type: Class
subclass of: Event Triggered Execution
subclass of: Restriction
  on property: loads
  some values from: Executable Binary
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database
type: NamedIndividual
loads: Executable Binary
modifies: System Configuration Database
definition: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry.
attack-id: T1546.015

Installer Packages
type: Class
subclass of: Event Triggered Execution
attack-id: T1546.016
definition: Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)

Udev Rules
type: Class
subclass of: Event Triggered Execution
attack-id: T1546.017
definition: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys` to specify the conditions a hardware event must meet and `action keys` to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in `/etc/udev/rules.d/`, `/run/udev/rules.d/`, `/usr/lib/udev/rules.d/`, `/usr/local/lib/udev/rules.d/`, and `/lib/udev/rules.d/`. Rule priority is determined by both directory and by the digit prefix in the rule filename.(Citation: Ignacio Udev research 2024)(Citation: Elastic Linux Persistence 2024)

Boot or Logon Autostart Execution
type: Class
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1547
definition: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Registry Run Keys / Startup Folder
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Init Database Record
subclass of: Restriction
  on property: may-modify
  some values from: UserStartupScriptFile
type: NamedIndividual
may-modify: System Configuration Init Database Record
may-modify: UserStartupScriptFile
definition: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.
attack-id: T1547.001

Authentication Package
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record
definition: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages)
attack-id: T1547.002

Time Providers
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record
attack-id: T1547.003
definition: Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)

Winlogon Helper DLL
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record
attack-id: T1547.004
definition: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013)

Security Support Provider
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record
definition: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.
attack-id: T1547.005

Kernel Modules and Extensions
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: Kernel Module
type: NamedIndividual
modifies: Kernel Module
definition: Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming)
attack-id: T1547.006

Re-opened Applications
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration File
type: NamedIndividual
modifies: Application Configuration File
definition: Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.(Citation: Methods of Mac Malware Persistence)(Citation: Wardle Persistence Chapter) Applications listed in this file are automatically reopened upon the user’s next logon.
attack-id: T1547.007

LSASS Driver
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: may-create
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Service Software
type: NamedIndividual
may-create: Shared Library File
modifies: System Service Software
attack-id: T1547.008
definition: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem)

Shortcut Modification
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: may-modify
  some values from: Symbolic Link
subclass of: Restriction
  on property: may-modify
  some values from: UserStartupScriptFile
type: NamedIndividual
may-modify: Symbolic Link
may-modify: UserStartupScriptFile
definition: Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
attack-id: T1547.009

Port Monitors
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record
attack-id: T1547.010
definition: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\Windows\System32 and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham)

Plist Modification
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration File
type: NamedIndividual
modifies: Application Configuration File
deprecated: true
attack-id: T1547.011
comment: This technique has been revoked by T1647
definition: Adversaries can modify property list files (plist files) to execute their code as part of establishing persistence. Plist files are used by macOS applications to store properties and configuration settings for applications and services. Applications use information plist files, Info.plist, to tell the operating system how to handle the application at runtime using structured metadata in the form of keys and values. Plist files are formatted in XML and based on Apple's Core Foundation DTD and can be saved in text or binary format.(Citation: fileinfo plist file description)

Print Processors
type: Class
subclass of: Boot or Logon Autostart Execution
attack-id: T1547.012
definition: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)

XDG Autostart Entries
type: Class
subclass of: Boot or Logon Autostart Execution
attack-id: T1547.013
definition: Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: Free Desktop Entry Keys)

Active Setup
type: Class
subclass of: Boot or Logon Autostart Execution
attack-id: T1547.014
definition: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level.

Login Items
type: Class
subclass of: Boot or Logon Autostart Execution
subclass of: Restriction
  on property: modifies
  some values from: UserLogonInitResource
type: NamedIndividual
modifies: UserLogonInitResource
definition: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.
attack-id: T1547.015

Abuse Elevation Control Mechanism
type: Class
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique
attack-id: T1548
definition: Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)

Setuid and Setgid
type: Class
subclass of: Abuse Elevation Control Mechanism
subclass of: Restriction
  on property: modifies
  some values from: Access Control Configuration
type: NamedIndividual
modifies: Access Control Configuration
attack-id: T1548.001
definition: An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.

Bypass User Account Control
type: Class
subclass of: Abuse Elevation Control Mechanism
subclass of: Restriction
  on property: executes
  some values from: Executable File
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database Record
type: NamedIndividual
executes: Executable File
invokes: Create Process
may-modify: System Configuration Database Record
attack-id: T1548.002
definition: Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)

Sudo and Sudo Caching
type: Class
subclass of: Abuse Elevation Control Mechanism
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
subclass of: Restriction
  on property: modifies
  some values from: Operating System Configuration File
type: NamedIndividual
may-modify: Event Log
modifies: Operating System Configuration File
attack-id: T1548.003
definition: Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Elevated Execution with Prompt
type: Class
subclass of: Abuse Elevation Control Mechanism
subclass of: Restriction
  on property: creates
  some values from: System Configuration Database
subclass of: Restriction
  on property: invokes
  some values from: System Call
type: NamedIndividual
creates: System Configuration Database
invokes: System Call
definition: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.
attack-id: T1548.004

Temporary Elevated Cloud Access
type: Class
subclass of: Abuse Elevation Control Mechanism
attack-id: T1548.005
definition: Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own.

TCC Manipulation
type: Class
subclass of: Abuse Elevation Control Mechanism
attack-id: T1548.006
definition: Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to execute malicious applications with elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).

Use Alternate Authentication Material
type: Class
subclass of: Defense Evasion Technique
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: accesses
  some values from: Authentication Service
type: NamedIndividual
accesses: Authentication Service
attack-id: T1550
definition: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Application Access Token
type: Class
subclass of: Use Alternate Authentication Material
subclass of: Restriction
  on property: may-produce
  some values from: Network Traffic
subclass of: Restriction
  on property: uses
  some values from: Access Token
type: NamedIndividual
may-produce: Network Traffic
uses: Access Token
definition: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
attack-id: T1550.001

Pass the Hash
type: Class
subclass of: Use Alternate Authentication Material
subclass of: Restriction
  on property: creates
  some values from: Authentication
type: NamedIndividual
creates: Authentication
definition: Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.
attack-id: T1550.002

Pass the Ticket
type: Class
subclass of: Use Alternate Authentication Material
subclass of: Restriction
  on property: creates
  some values from: Authentication
type: NamedIndividual
creates: Authentication
definition: Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
attack-id: T1550.003

Web Session Cookie
type: Class
subclass of: Use Alternate Authentication Material
subclass of: Restriction
  on property: adds
  some values from: Session Cookie
subclass of: Restriction
  on property: produces
  some values from: WebNetworkTraffic
type: NamedIndividual
adds: Session Cookie
produces: WebNetworkTraffic
definition: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)
attack-id: T1550.004

Unsecured Credentials
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: accesses
  some values from: Credential
type: NamedIndividual
accesses: Credential
attack-id: T1552
definition: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)

Credentials In Files
type: Class
subclass of: Unsecured Credentials
subclass of: Restriction
  on property: accesses
  some values from: File
type: NamedIndividual
accesses: File
definition: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
attack-id: T1552.001

Credentials in Registry
type: Class
subclass of: Unsecured Credentials
subclass of: Restriction
  on property: accesses
  some values from: System Configuration Database
type: NamedIndividual
accesses: System Configuration Database
definition: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
attack-id: T1552.002

Bash History
type: Class
subclass of: Unsecured Credentials
subclass of: Restriction
  on property: accesses
  some values from: Command History Log File
type: NamedIndividual
accesses: Command History Log File
definition: Adversaries may search the bash command history on compromised systems for insecurely stored credentials. Bash keeps track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)
attack-id: T1552.003

Private Keys
type: Class
subclass of: Unsecured Credentials
subclass of: Restriction
  on property: accesses
  some values from: Private Key
type: NamedIndividual
accesses: Private Key
definition: Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
attack-id: T1552.004

Cloud Instance Metadata API
type: Class
subclass of: Unsecured Credentials
subclass of: Restriction
  on property: accesses
  some values from: Cloud Instance Metadata
type: NamedIndividual
accesses: Cloud Instance Metadata
attack-id: T1552.005
definition: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

Group Policy Preferences
type: Class
subclass of: Unsecured Credentials
subclass of: Restriction
  on property: accesses
  some values from: Group Policy
type: NamedIndividual
accesses: Group Policy
attack-id: T1552.006
definition: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016)

Container API
type: Class
subclass of: Unsecured Credentials
attack-id: T1552.007
definition: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API)

Chat Messages
type: Class
subclass of: Unsecured Credentials
attack-id: T1552.008
definition: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.

Subvert Trust Controls
type: Class
subclass of: Defense Evasion Technique
attack-id: T1553
definition: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

Gatekeeper Bypass
type: Class
subclass of: Subvert Trust Controls
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
type: NamedIndividual
modifies: File System Metadata
definition: Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications.(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: TheEclecticLightCompany apple notarization )
attack-id: T1553.001

Code Signing
type: Class
subclass of: Subvert Trust Controls
subclass of: Restriction
  on property: enables
  some values from: Defense Evasion
type: NamedIndividual
enables: Defense Evasion
definition: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature.
attack-id: T1553.002

SIP and Trust Provider Hijacking
type: Class
subclass of: Subvert Trust Controls
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
modifies: System Configuration Database Record
attack-id: T1553.003
definition: Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)

Install Root Certificate
type: Class
subclass of: Subvert Trust Controls
subclass of: Restriction
  on property: modifies
  some values from: Certificate Trust Store
type: NamedIndividual
modifies: Certificate Trust Store
definition: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.(Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
attack-id: T1553.004

Mark-of-the-Web Bypass
type: Class
subclass of: Subvert Trust Controls
attack-id: T1553.005
definition: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)

Code Signing Policy Modification
type: Class
subclass of: Subvert Trust Controls
attack-id: T1553.006
definition: Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.

Compromise Host Software Binary
type: Class
subclass of: Persistence Technique
subclass of: Restriction
  on property: modifies
  some values from: Client Application
type: NamedIndividual
modifies: Client Application
attack-id: T1554
definition: Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.

Credentials from Password Stores
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: accesses
  some values from: Password Store
subclass of: Restriction
  on property: may-access
  some values from: Database File
type: NamedIndividual
accesses: Password Store
may-access: Database File
attack-id: T1555
definition: Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Keychain
type: Class
subclass of: Credentials from Password Stores
subclass of: Restriction
  on property: accesses
  some values from: MacOS Keychain
type: NamedIndividual
accesses: MacOS Keychain
definition: Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.
attack-id: T1555.001

Securityd Memory
type: Class
subclass of: Credentials from Password Stores
subclass of: Restriction
  on property: accesses
  some values from: In-memory Password Store
type: NamedIndividual
accesses: In-memory Password Store
attack-id: T1555.002
definition: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware)

Credentials from Web Browsers
type: Class
subclass of: Credentials from Password Stores
subclass of: Restriction
  on property: accesses
  some values from: Database File
subclass of: Restriction
  on property: may-access
  some values from: In-memory Password Store
subclass of: Restriction
  on property: may-invoke
  some values from: Read File
type: NamedIndividual
accesses: Database File
may-access: In-memory Password Store
may-invoke: Read File
definition: Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
attack-id: T1555.003

Windows Credential Manager
type: Class
subclass of: Credentials from Password Stores
attack-id: T1555.004
definition: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)

Password Managers
type: Class
subclass of: Credentials from Password Stores
attack-id: T1555.005
definition: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)

Cloud Secrets Management Stores
type: Class
subclass of: Credentials from Password Stores
attack-id: T1555.006
definition: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

Modify Authentication Process
type: Class
subclass of: Credential Access Technique
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: modifies
  some values from: Authentication Service
type: NamedIndividual
modifies: Authentication Service
attack-id: T1556
definition: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Domain Controller Authentication
type: Class
subclass of: Modify Authentication Process
attack-id: T1556.001
definition: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.

Password Filter DLL
type: Class
subclass of: Modify Authentication Process
subclass of: Restriction
  on property: creates
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
creates: Shared Library File
modifies: System Configuration Database Record
attack-id: T1556.002
definition: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.

Pluggable Authentication Modules
type: Class
subclass of: Modify Authentication Process
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Configuration File
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Shared Library File
type: NamedIndividual
may-modify: Operating System Configuration File
may-modify: Operating System Shared Library File
attack-id: T1556.003
definition: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)

Network Device Authentication
type: Class
subclass of: Modify Authentication Process
attack-id: T1556.004
definition: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

Reversible Encryption
type: Class
subclass of: Modify Authentication Process
attack-id: T1556.005
definition: An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)

Multi-Factor Authentication
type: Class
subclass of: Modify Authentication Process
attack-id: T1556.006
definition: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Hybrid Identity
type: Class
subclass of: Modify Authentication Process
attack-id: T1556.007
definition: Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.

Network Provider DLL
type: Class
subclass of: Modify Authentication Process
attack-id: T1556.008
definition: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify)

Conditional Access Policies
type: Class
subclass of: Modify Authentication Process
attack-id: T1556.009
definition: Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.

Adversary-in-the-Middle
type: Class
subclass of: Collection Technique
subclass of: Credential Access Technique
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
type: NamedIndividual
produces: Network Traffic
attack-id: T1557
definition: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)

LLMNR/NBT-NS Poisoning and SMB Relay
type: Class
subclass of: Adversary-in-the-Middle
subclass of: Restriction
  on property: produces
  some values from: Intranet Multicast Network Traffic
type: NamedIndividual
produces: Intranet Multicast Network Traffic
attack-id: T1557.001
definition: By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.

ARP Cache Poisoning
type: Class
subclass of: Adversary-in-the-Middle
attack-id: T1557.002
definition: Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

DHCP Spoofing
type: Class
subclass of: Adversary-in-the-Middle
subclass of: Restriction
  on property: creates
  some values from: DHCP Network Traffic
type: NamedIndividual
creates: DHCP Network Traffic
attack-id: T1557.003
definition: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

Evil Twin
type: Class
subclass of: Adversary-in-the-Middle
attack-id: T1557.004
definition: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or [Input Capture](https://attack.mitre.org/techniques/T1056).(Citation: Australia ‘Evil Twin’)

Steal or Forge Kerberos Tickets
type: Class
subclass of: Credential Access Technique
subclass of: Restriction
  on property: may-access
  some values from: Kerberos Ticket
subclass of: Restriction
  on property: may-create
  some values from: Kerberos Ticket
type: NamedIndividual
may-access: Kerberos Ticket
may-create: Kerberos Ticket
definition: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
attack-id: T1558

Golden Ticket
type: Class
subclass of: Steal or Forge Kerberos Tickets
subclass of: Restriction
  on property: forges
  some values from: Kerberos Ticket Granting Ticket
type: NamedIndividual
forges: Kerberos Ticket Granting Ticket
attack-id: T1558.001
definition: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection)

Silver Ticket
type: Class
subclass of: Steal or Forge Kerberos Tickets
attack-id: T1558.002
definition: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets)

Kerberoasting
type: Class
subclass of: Steal or Forge Kerberos Tickets
subclass of: Restriction
  on property: may-produce
  some values from: RPC Network Traffic
type: NamedIndividual
may-produce: RPC Network Traffic
attack-id: T1558.003
definition: Service Provider Name (SPN) scanning is one way to gather hashes, which results in RPC calls conforming to the NSPI protocol.

AS-REP Roasting
type: Class
subclass of: Steal or Forge Kerberos Tickets
attack-id: T1558.004
definition: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017)

Ccache Files
type: Class
subclass of: Steal or Forge Kerberos Tickets
attack-id: T1558.005
definition: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.

Inter-Process Communication
type: Class
subclass of: Execution Technique
subclass of: Restriction
  on property: injects
  some values from: Interprocess Communication
type: NamedIndividual
injects: Interprocess Communication
attack-id: T1559
definition: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Component Object Model
type: Class
subclass of: Inter-Process Communication
attack-id: T1559.001
definition: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)

Dynamic Data Exchange
type: Class
subclass of: Inter-Process Communication
attack-id: T1559.002
definition: Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

XPC Services
type: Class
subclass of: Inter-Process Communication
attack-id: T1559.003
definition: Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections). Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev)

Archive Collected Data
type: Class
subclass of: Collection Technique
subclass of: Restriction
  on property: creates
  some values from: Archive File
type: NamedIndividual
creates: Archive File
attack-id: T1560
definition: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Archive via Utility
type: Class
subclass of: Archive Collected Data
subclass of: Restriction
  on property: creates
  some values from: Archive File
type: NamedIndividual
creates: Archive File
attack-id: T1560.001
definition: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Archive via Library
type: Class
subclass of: Archive Collected Data
subclass of: Restriction
  on property: creates
  some values from: Archive File
type: NamedIndividual
creates: Archive File
attack-id: T1560.002
definition: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data.

Archive via Custom Method
type: Class
subclass of: Archive Collected Data
subclass of: Restriction
  on property: creates
  some values from: Custom Archive File
type: NamedIndividual
creates: Custom Archive File
attack-id: T1560.003
definition: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)

Disk Wipe
type: Class
subclass of: Impact Technique
attack-id: T1561
definition: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.

Disk Content Wipe
type: Class
subclass of: Disk Wipe
subclass of: Restriction
  on property: may-modify
  some values from: Boot Sector
subclass of: Restriction
  on property: may-modify
  some values from: Partition
subclass of: Restriction
  on property: may-modify
  some values from: Partition Table
subclass of: Restriction
  on property: may-modify
  some values from: Volume
subclass of: Restriction
  on property: modifies
  some values from: Block Device
type: NamedIndividual
may-modify: Boot Sector
may-modify: Partition
may-modify: Partition Table
may-modify: Volume
modifies: Block Device
definition: Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
attack-id: T1561.001

Disk Structure Wipe
type: Class
subclass of: Disk Wipe
subclass of: Restriction
  on property: may-modify
  some values from: Boot Sector
subclass of: Restriction
  on property: may-modify
  some values from: Partition Table
type: NamedIndividual
may-modify: Boot Sector
may-modify: Partition Table
definition: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.
attack-id: T1561.002

Impair Defenses
type: Class
subclass of: Defense Evasion Technique
attack-id: T1562
definition: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Disable or Modify Tools
type: Class
subclass of: Impair Defenses
subclass of: Restriction
  on property: disables
  some values from: Operating System Process
type: NamedIndividual
disables: Operating System Process
attack-id: T1562.001
definition: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)

Disable Windows Event Logging
type: Class
subclass of: Impair Defenses
subclass of: Restriction
  on property: may-modify
  some values from: Application Configuration
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Configuration Component
type: NamedIndividual
may-modify: Application Configuration
may-modify: Operating System Configuration Component
definition: Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.
attack-id: T1562.002

Impair Command History Logging
type: Class
subclass of: Impair Defenses
subclass of: Restriction
  on property: may-modify
  some values from: UserInitScript
subclass of: Restriction
  on property: may-modify
  some values from: WindowsRegistryKey
subclass of: Restriction
  on property: modifies
  some values from: Process Environment Variable
type: NamedIndividual
may-modify: UserInitScript
may-modify: WindowsRegistryKey
modifies: Process Environment Variable
definition: Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
attack-id: T1562.003

Disable or Modify System Firewall
type: Class
subclass of: Impair Defenses
subclass of: Restriction
  on property: modifies
  some values from: System Firewall Configuration
type: NamedIndividual
modifies: System Firewall Configuration
definition: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
attack-id: T1562.004

Indicator Blocking
type: Class
subclass of: Impair Defenses
attack-id: T1562.006
definition: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting(Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW)(Citation: Microsoft About Event Tracing 2018), by tampering settings that control the collection and flow of event telemetry.(Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).

Disable or Modify Cloud Firewall
type: Class
subclass of: Impair Defenses
attack-id: T1562.007
definition: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).

Disable or Modify Cloud Logs
type: Class
subclass of: Impair Defenses
attack-id: T1562.008
definition: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.

Safe Mode Boot
type: Class
subclass of: Impair Defenses
subclass of: Restriction
  on property: disables
  some values from: Endpoint Sensor
subclass of: Restriction
  on property: disables
  some values from: System Configuration Init Database Record
subclass of: Restriction
  on property: may-modify
  some values from: Endpoint Health Beacon
type: NamedIndividual
disables: Endpoint Sensor
disables: System Configuration Init Database Record
may-modify: Endpoint Health Beacon
attack-id: T1562.009
definition: Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Safe Mode)(Citation: Sophos Snatch Ransomware 2019)

Downgrade Attack
type: Class
subclass of: Impair Defenses
subclass of: Restriction
  on property: accesses
  some values from: Legacy System
type: NamedIndividual
accesses: Legacy System
definition: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.
attack-id: T1562.010

Spoof Security Alerting
type: Class
subclass of: Impair Defenses
attack-id: T1562.011
definition: Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.(Citation: BlackBasta) Messages produced by defensive tools contain information about potential security events as well as the functioning status of security software and the system. Security reporting messages are important for monitoring the normal operation of a system and identifying important events that can signal a security incident.

Disable or Modify Linux Audit System
type: Class
subclass of: Impair Defenses
attack-id: T1562.012
definition: Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules.

Remote Service Session Hijacking
type: Class
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: accesses
  some values from: Remote Session
subclass of: Restriction
  on property: produces
  some values from: Administrative Network Traffic
type: NamedIndividual
accesses: Remote Session
produces: Administrative Network Traffic
definition: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.
attack-id: T1563

SSH Hijacking
type: Class
subclass of: Remote Service Session Hijacking
subclass of: Restriction
  on property: accesses
  some values from: SSH Session
type: NamedIndividual
accesses: SSH Session
attack-id: T1563.001
definition: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.

RDP Hijacking
type: Class
subclass of: Remote Service Session Hijacking
subclass of: Restriction
  on property: accesses
  some values from: RDP Session
type: NamedIndividual
accesses: RDP Session
attack-id: T1563.002
definition: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)

Hide Artifacts
type: Class
subclass of: Defense Evasion Technique
attack-id: T1564
definition: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015)

Hidden Files and Directories
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
type: NamedIndividual
modifies: File System Metadata
definition: Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
attack-id: T1564.001

Hidden Users
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: modifies
  some values from: UserInitConfigurationFile
type: NamedIndividual
modifies: UserInitConfigurationFile
definition: Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
attack-id: T1564.002

Hidden Window
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: may-modify
  some values from: Property List File
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database
type: NamedIndividual
may-modify: Property List File
may-modify: System Configuration Database
definition: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
attack-id: T1564.003

NTFS File Attributes
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
type: NamedIndividual
modifies: File System Metadata
attack-id: T1564.004
definition: Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)

Hidden File System
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database
subclass of: Restriction
  on property: modifies
  some values from: Storage
type: NamedIndividual
may-modify: System Configuration Database
modifies: Storage
definition: Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014)
attack-id: T1564.005

Run Virtual Instance
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: creates
  some values from: File
subclass of: Restriction
  on property: executes
  some values from: VirtualizationSoftware
subclass of: Restriction
  on property: may-add
  some values from: VirtualizationSoftware
subclass of: Restriction
  on property: may-create
  some values from: Directory
type: NamedIndividual
creates: File
executes: VirtualizationSoftware
may-add: VirtualizationSoftware
may-create: Directory
attack-id: T1564.006
definition: Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)

VBA Stomping
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: modifies
  some values from: Office Application File
type: NamedIndividual
modifies: Office Application File
attack-id: T1564.007
definition: Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020)

Email Hiding Rules
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: may-create
  some values from: Email Rule
subclass of: Restriction
  on property: may-modify
  some values from: Email Rule
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration
type: NamedIndividual
may-create: Email Rule
may-modify: Email Rule
modifies: Application Configuration
attack-id: T1564.008
definition: Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)

Resource Forking
type: Class
subclass of: Hide Artifacts
subclass of: Restriction
  on property: may-create
  some values from: Resource Fork
subclass of: Restriction
  on property: may-modify
  some values from: Resource Fork
type: NamedIndividual
may-create: Resource Fork
may-modify: Resource Fork
attack-id: T1564.009
definition: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes)

Process Argument Spoofing
type: Class
subclass of: Hide Artifacts
attack-id: T1564.010
definition: Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process command-line arguments that are referenced when executing the process. When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB.(Citation: Microsoft PEB 2021)(Citation: Xpn Argue Like Cobalt 2019)

Ignore Process Interrupts
type: Class
subclass of: Hide Artifacts
attack-id: T1564.011
definition: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes.

File/Path Exclusions
type: Class
subclass of: Hide Artifacts
attack-id: T1564.012
definition: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions)

Bind Mounts
type: Class
subclass of: Hide Artifacts
attack-id: T1564.013
definition: Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access.

Extended Attributes
type: Class
subclass of: Hide Artifacts
attack-id: T1564.014
definition: Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like `Finder`, `ls`, or `cat` and require utilities such as `xattr` (macOS) or `getfattr` (Linux) for inspection. Operating systems and applications use xattrs for tagging, integrity checks, and access control. On Linux, xattrs are organized into namespaces such as `user.` (user permissions), `trusted.` (root permissions), `security.`, and `system.`, each with specific permissions. On macOS, xattrs are flat strings without namespace prefixes, commonly prefixed with `com.apple.*` (e.g., `com.apple.quarantine`, `com.apple.metadata:_kMDItemUserTags`) and used by system features like Gatekeeper and Spotlight.(Citation: Establishing persistence using extended attributes on Linux)

Data Manipulation
type: Class
subclass of: Impact Technique
attack-id: T1565
definition: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

Stored Data Manipulation
type: Class
subclass of: Data Manipulation
subclass of: Restriction
  on property: modifies
  some values from: File
type: NamedIndividual
modifies: File
attack-id: T1565.001
definition: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Transmitted Data Manipulation
type: Class
subclass of: Data Manipulation
subclass of: Restriction
  on property: may-modify
  some values from: Network Traffic
type: NamedIndividual
may-modify: Network Traffic
attack-id: T1565.002
definition: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Runtime Data Manipulation
type: Class
subclass of: Data Manipulation
subclass of: Restriction
  on property: may-modify
  some values from: Executable File
type: NamedIndividual
may-modify: Executable File
attack-id: T1565.003
definition: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Phishing
type: Class
subclass of: Initial Access Technique
attack-id: T1566
definition: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Spearphishing Attachment
type: Class
subclass of: Phishing
subclass of: Restriction
  on property: produces
  some values from: Email
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Mail Traffic
type: NamedIndividual
produces: Email
produces: Inbound Internet Mail Traffic
attack-id: T1566.001
definition: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Spearphishing Link
type: Class
subclass of: Phishing
subclass of: Restriction
  on property: produces
  some values from: Email
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Mail Traffic
subclass of: Restriction
  on property: produces
  some values from: URL
type: NamedIndividual
produces: Email
produces: Inbound Internet Mail Traffic
produces: URL
attack-id: T1566.002
definition: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Spearphishing via Service
type: Class
subclass of: Phishing
subclass of: Restriction
  on property: produces
  some values from: File
subclass of: Restriction
  on property: produces
  some values from: URL
type: NamedIndividual
produces: File
produces: URL
attack-id: T1566.003
definition: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Spearphishing Voice
type: Class
subclass of: Phishing
attack-id: T1566.004
definition: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.

Exfiltration Over Web Service
type: Class
subclass of: Exfiltration Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Web Traffic
type: NamedIndividual
produces: Outbound Internet Web Traffic
attack-id: T1567
definition: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Exfiltration to Code Repository
type: Class
subclass of: Exfiltration Over Web Service
subclass of: Restriction
  on property: may-produce
  some values from: Outbound Internet Encrypted Remote Terminal Traffic
subclass of: Restriction
  on property: may-produce
  some values from: Outbound Internet Encrypted Web Traffic
type: NamedIndividual
may-produce: Outbound Internet Encrypted Remote Terminal Traffic
may-produce: Outbound Internet Encrypted Web Traffic
attack-id: T1567.001
definition: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.

Exfiltration to Cloud Storage
type: Class
subclass of: Exfiltration Over Web Service
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Web Traffic
type: NamedIndividual
produces: Outbound Internet Encrypted Web Traffic
attack-id: T1567.002
definition: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Exfiltration to Text Storage Sites
type: Class
subclass of: Exfiltration Over Web Service
attack-id: T1567.003
definition: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.

Exfiltration Over Webhook
type: Class
subclass of: Exfiltration Over Web Service
attack-id: T1567.004
definition: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.

Dynamic Resolution
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet DNS Lookup Traffic
type: NamedIndividual
produces: Outbound Internet DNS Lookup Traffic
attack-id: T1568
definition: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Fast Flux DNS
type: Class
subclass of: Dynamic Resolution
attack-id: T1568.001
definition: Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity)

Domain Generation Algorithms
type: Class
subclass of: Dynamic Resolution
attack-id: T1568.002
definition: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)

DNS Calculation
type: Class
subclass of: Dynamic Resolution
attack-id: T1568.003
definition: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda)

System Services
type: Class
subclass of: Execution Technique
attack-id: T1569
definition: This technique has been deprecated.

Launchctl
type: Class
subclass of: System Services
attack-id: T1569.001
definition: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)

Service Execution
type: Class
subclass of: System Services
attack-id: T1569.002
definition: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).

Systemctl
type: Class
subclass of: System Services
attack-id: T1569.003
definition: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications.

Lateral Tool Transfer
type: Class
subclass of: Lateral Movement Technique
subclass of: Restriction
  on property: produces
  some values from: Intranet File Transfer Traffic
type: NamedIndividual
produces: Intranet File Transfer Traffic
definition: Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
attack-id: T1570

Non-Standard Port
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
definition: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
attack-id: T1571

Protocol Tunneling
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
type: NamedIndividual
produces: Outbound Internet Network Traffic
definition: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
attack-id: T1572

Encrypted Channel
type: Class
subclass of: Command and Control Technique
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Traffic
type: NamedIndividual
produces: Outbound Internet Encrypted Traffic
definition: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
alternative label: Multilayer Encryption
alternative label: Custom Cryptographic Protocol
attack-id: T1573
alternative label: Custom Command and Control Protocol

Symmetric Cryptography
type: Class
subclass of: Encrypted Channel
subclass of: Restriction
  on property: creates
  some values from: Outbound Internet Encrypted Traffic
type: NamedIndividual
creates: Outbound Internet Encrypted Traffic
attack-id: T1573.001
definition: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Asymmetric Cryptography
type: Class
subclass of: Encrypted Channel
subclass of: Restriction
  on property: creates
  some values from: Outbound Internet Encrypted Traffic
subclass of: Restriction
  on property: may-transfer
  some values from: Certificate File
type: NamedIndividual
creates: Outbound Internet Encrypted Traffic
may-transfer: Certificate File
attack-id: T1573.002
definition: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

Hijack Execution Flow
type: Class
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique
attack-id: T1574
definition: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

DLL
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: may-create
  some values from: Shared Library File
type: NamedIndividual
may-create: Shared Library File
attack-id: T1574.001
definition: Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

DLL Side-Loading
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: may-create
  some values from: Shared Library File
subclass of: Restriction
  on property: may-modify
  some values from: Shared Library File
type: NamedIndividual
may-create: Shared Library File
may-modify: Shared Library File
attack-id: T1574.002
deprecated: true
comment: This technique has been revoked by T1574.001
definition: Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).

Dylib Hijacking
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: may-create
  some values from: Shared Library File
subclass of: Restriction
  on property: may-modify
  some values from: Shared Library File
type: NamedIndividual
may-create: Shared Library File
may-modify: Shared Library File
attack-id: T1574.004
definition: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with @rpath, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the LC_LOAD_WEAK_DYLIB function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.

Executable Installer File Permissions Weakness
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: modifies
  some values from: Service Application
type: NamedIndividual
modifies: Service Application
definition: Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
attack-id: T1574.005

Dynamic Linker Hijacking
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: modifies
  some values from: Operating System Configuration File
type: NamedIndividual
modifies: Operating System Configuration File
attack-id: T1574.006
definition: Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions without changing the original library.(Citation: Baeldung LD_PRELOAD)

Path Interception by PATH Environment Variable
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: creates
  some values from: Executable File
type: NamedIndividual
creates: Executable File
definition: Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line.
attack-id: T1574.007

Path Interception by Search Order Hijacking
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: creates
  some values from: Executable File
type: NamedIndividual
creates: Executable File
definition: Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.
attack-id: T1574.008

Path Interception by Unquoted Path
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: creates
  some values from: Executable File
type: NamedIndividual
creates: Executable File
definition: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
attack-id: T1574.009

Services File Permissions Weakness
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: modifies
  some values from: Service Application
type: NamedIndividual
modifies: Service Application
attack-id: T1574.010
definition: Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
alternative label: Service Registry Permissions Weakness

Services Registry Permissions Weakness
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Init Database Record
type: NamedIndividual
modifies: System Configuration Init Database Record
attack-id: T1574.011
definition: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)

COR_PROFILER
type: Class
subclass of: Hijack Execution Flow
subclass of: Restriction
  on property: adds
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
type: NamedIndividual
adds: Shared Library File
modifies: System Configuration Database Record
attack-id: T1574.012
definition: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)

KernelCallbackTable
type: Class
subclass of: Hijack Execution Flow
attack-id: T1574.013
definition: Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.(Citation: Lazarus APT January 2022)(Citation: FinFisher exposed ) The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.(Citation: Windows Process Injection KernelCallbackTable)

AppDomainManager
type: Class
subclass of: Hijack Execution Flow
attack-id: T1574.014
definition: Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.(Citation: Microsoft App Domains)

Modify Cloud Compute Infrastructure
type: Class
subclass of: Defense Evasion Technique
attack-id: T1578
definition: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.

Create Snapshot
type: Class
subclass of: Modify Cloud Compute Infrastructure
attack-id: T1578.001
definition: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.

Create Cloud Instance
type: Class
subclass of: Modify Cloud Compute Infrastructure
attack-id: T1578.002
definition: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020)

Delete Cloud Instance
type: Class
subclass of: Modify Cloud Compute Infrastructure
attack-id: T1578.003
definition: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.

Revert Cloud Instance
type: Class
subclass of: Modify Cloud Compute Infrastructure
attack-id: T1578.004
definition: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.

Modify Cloud Compute Configurations
type: Class
subclass of: Modify Cloud Compute Infrastructure
attack-id: T1578.005
definition: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim.

Cloud Infrastructure Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1580
definition: An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.

Acquire Infrastructure
type: Class
subclass of: Resource Development Technique
attack-id: T1583
definition: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.(Citation: Free Trial PurpleUrchin) Additionally, botnets are available for rent or purchase.

Domains
type: Class
subclass of: Acquire Infrastructure
attack-id: T1583.001
definition: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.

DNS Server
type: Class
subclass of: Acquire Infrastructure
attack-id: T1583.002
definition: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations.

Virtual Private Server
type: Class
subclass of: Acquire Infrastructure
attack-id: T1583.003
definition: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.

Server
type: Class
subclass of: Acquire Infrastructure
attack-id: T1583.004
definition: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked)

Botnet
type: Class
subclass of: Acquire Infrastructure
attack-id: T1583.005
definition: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter)

Web Services
type: Class
subclass of: Acquire Infrastructure
attack-id: T1583.006
definition: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.

Serverless
type: Class
subclass of: Acquire Infrastructure
attack-id: T1583.007
definition: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.

Malvertising
type: Class
subclass of: Acquire Infrastructure
attack-id: T1583.008
definition: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.

Compromise Infrastructure
type: Class
subclass of: Resource Development Technique
attack-id: T1584
definition: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.

Domains
type: Class
subclass of: Compromise Infrastructure
attack-id: T1584.001
definition: Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.(Citation: Krebs DNS Hijack 2019)

DNS Server
type: Class
subclass of: Compromise Infrastructure
attack-id: T1584.002
definition: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.

Virtual Private Server
type: Class
subclass of: Compromise Infrastructure
attack-id: T1584.003
definition: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)

Server
type: Class
subclass of: Compromise Infrastructure
attack-id: T1584.004
definition: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations.

Botnet
type: Class
subclass of: Compromise Infrastructure
attack-id: T1584.005
definition: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).

Web Services
type: Class
subclass of: Compromise Infrastructure
attack-id: T1584.006
definition: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.

Serverless
type: Class
subclass of: Compromise Infrastructure
attack-id: T1584.007
definition: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.

Network Devices
type: Class
subclass of: Compromise Infrastructure
attack-id: T1584.008
definition: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment -- instead leveraging these devices to support additional targeting.

Establish Accounts
type: Class
subclass of: Resource Development Technique
attack-id: T1585
definition: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Social Media Accounts
type: Class
subclass of: Establish Accounts
attack-id: T1585.001
definition: Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Email Accounts
type: Class
subclass of: Establish Accounts
attack-id: T1585.002
definition: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin)

Cloud Accounts
type: Class
subclass of: Establish Accounts
attack-id: T1585.003
definition: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)

Compromise Accounts
type: Class
subclass of: Resource Development Technique
attack-id: T1586
definition: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.

Social Media Accounts
type: Class
subclass of: Compromise Accounts
attack-id: T1586.001
definition: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.

Email Accounts
type: Class
subclass of: Compromise Accounts
attack-id: T1586.002
definition: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).

Cloud Accounts
type: Class
subclass of: Compromise Accounts
attack-id: T1586.003
definition: Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)

Develop Capabilities
type: Class
subclass of: Resource Development Technique
attack-id: T1587
definition: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)

Malware
type: Class
subclass of: Develop Capabilities
attack-id: T1587.001
definition: Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)

Code Signing Certificates
type: Class
subclass of: Develop Capabilities
attack-id: T1587.002
definition: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.

Digital Certificates
type: Class
subclass of: Develop Capabilities
attack-id: T1587.003
definition: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).

Exploits
type: Class
subclass of: Develop Capabilities
attack-id: T1587.004
definition: Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: Irongeek Sims BSides 2017)

Obtain Capabilities
type: Class
subclass of: Resource Development Technique
attack-id: T1588
definition: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Malware
type: Class
subclass of: Obtain Capabilities
attack-id: T1588.001
definition: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.

Tool
type: Class
subclass of: Obtain Capabilities
attack-id: T1588.002
definition: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019)

Code Signing Certificates
type: Class
subclass of: Obtain Capabilities
attack-id: T1588.003
definition: Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.

Digital Certificates
type: Class
subclass of: Obtain Capabilities
attack-id: T1588.004
definition: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

Exploits
type: Class
subclass of: Obtain Capabilities
attack-id: T1588.005
definition: Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying)

Vulnerabilities
type: Class
subclass of: Obtain Capabilities
attack-id: T1588.006
definition: Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database)

Artificial Intelligence
type: Class
subclass of: Obtain Capabilities
attack-id: T1588.007
definition: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI)

Gather Victim Identity Information
type: Class
subclass of: Reconnaissance Technique
attack-id: T1589
definition: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.

Credentials
type: Class
subclass of: Gather Victim Identity Information
attack-id: T1589.001
definition: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.

Email Addresses
type: Class
subclass of: Gather Victim Identity Information
attack-id: T1589.002
definition: Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.

Employee Names
type: Class
subclass of: Gather Victim Identity Information
attack-id: T1589.003
definition: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.

Gather Victim Network Information
type: Class
subclass of: Reconnaissance Technique
attack-id: T1590
definition: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

Domain Properties
type: Class
subclass of: Gather Victim Network Information
attack-id: T1590.001
definition: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.

DNS
type: Class
subclass of: Gather Victim Network Information
attack-id: T1590.002
definition: Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. DNS, MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.(Citation: Sean Metcalf Twitter DNS Records)

Network Trust Dependencies
type: Class
subclass of: Gather Victim Network Information
attack-id: T1590.003
definition: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access.

Network Topology
type: Class
subclass of: Gather Victim Network Information
attack-id: T1590.004
definition: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure.

IP Addresses
type: Class
subclass of: Gather Victim Network Information
attack-id: T1590.005
definition: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted.

Network Security Appliances
type: Class
subclass of: Gather Victim Network Information
attack-id: T1590.006
definition: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations.

Gather Victim Org Information
type: Class
subclass of: Reconnaissance Technique
attack-id: T1591
definition: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.

Determine Physical Locations
type: Class
subclass of: Gather Victim Org Information
attack-id: T1591.001
definition: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.

Business Relationships
type: Class
subclass of: Gather Victim Org Information
attack-id: T1591.002
definition: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.

Identify Business Tempo
type: Class
subclass of: Gather Victim Org Information
attack-id: T1591.003
definition: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources.

Identify Roles
type: Class
subclass of: Gather Victim Org Information
attack-id: T1591.004
definition: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to.

Gather Victim Host Information
type: Class
subclass of: Reconnaissance Technique
attack-id: T1592
definition: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).

Hardware
type: Class
subclass of: Gather Victim Host Information
attack-id: T1592.001
definition: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.).

Software
type: Class
subclass of: Gather Victim Host Information
attack-id: T1592.002
definition: Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).

Firmware
type: Class
subclass of: Gather Victim Host Information
attack-id: T1592.003
definition: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.).

Client Configurations
type: Class
subclass of: Gather Victim Host Information
attack-id: T1592.004
definition: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.

Search Open Websites/Domains
type: Class
subclass of: Reconnaissance Technique
attack-id: T1593
definition: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)

Social Media
type: Class
subclass of: Search Open Websites/Domains
attack-id: T1593.001
definition: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff.

Search Engines
type: Class
subclass of: Search Open Websites/Domains
attack-id: T1593.002
definition: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)

Code Repositories
type: Class
subclass of: Search Open Websites/Domains
attack-id: T1593.003
definition: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

Search Victim-Owned Websites
type: Class
subclass of: Reconnaissance Technique
attack-id: T1594
definition: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak)

Active Scanning
type: Class
subclass of: Reconnaissance Technique
attack-id: T1595
definition: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Scanning IP Blocks
type: Class
subclass of: Active Scanning
attack-id: T1595.001
definition: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.

Vulnerability Scanning
type: Class
subclass of: Active Scanning
attack-id: T1595.002
definition: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

Wordlist Scanning
type: Class
subclass of: Active Scanning
attack-id: T1595.003
definition: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).

Search Open Technical Databases
type: Class
subclass of: Reconnaissance Technique
attack-id: T1596
definition: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan)

DNS/Passive DNS
type: Class
subclass of: Search Open Technical Databases
attack-id: T1596.001
definition: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.

WHOIS
type: Class
subclass of: Search Open Technical Databases
attack-id: T1596.002
definition: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS)

Digital Certificates
type: Class
subclass of: Search Open Technical Databases
attack-id: T1596.003
definition: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location.

CDNs
type: Class
subclass of: Search Open Technical Databases
attack-id: T1596.004
definition: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region.

Scan Databases
type: Class
subclass of: Search Open Technical Databases
attack-id: T1596.005
definition: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan)

Search Closed Sources
type: Class
subclass of: Reconnaissance Technique
attack-id: T1597
definition: Adversaries may search and gather information about victims from closed sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds) Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data)

Threat Intel Vendors
type: Class
subclass of: Search Closed Sources
attack-id: T1597.001
definition: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds)

Purchase Technical Data
type: Class
subclass of: Search Closed Sources
attack-id: T1597.002
definition: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.

Phishing for Information
type: Class
subclass of: Reconnaissance Technique
attack-id: T1598
definition: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.

Spearphishing Service
type: Class
subclass of: Phishing for Information
attack-id: T1598.001
definition: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Spearphishing Attachment
type: Class
subclass of: Phishing for Information
attack-id: T1598.002
definition: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Spearphishing Link
type: Class
subclass of: Phishing for Information
attack-id: T1598.003
definition: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Spearphishing Voice
type: Class
subclass of: Phishing for Information
attack-id: T1598.004
definition: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.

Network Boundary Bridging
type: Class
subclass of: Defense Evasion Technique
attack-id: T1599
definition: Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.

Network Address Translation Traversal
type: Class
subclass of: Network Boundary Bridging
attack-id: T1599.001
definition: Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration. Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.

Weaken Encryption
type: Class
subclass of: Defense Evasion Technique
attack-id: T1600
definition: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications. (Citation: Cisco Synful Knock Evolution)

Reduce Key Space
type: Class
subclass of: Weaken Encryption
attack-id: T1600.001
definition: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution)

Disable Crypto Hardware
type: Class
subclass of: Weaken Encryption
attack-id: T1600.002
definition: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.

Modify System Image
type: Class
subclass of: Defense Evasion Technique
attack-id: T1601
definition: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.

Patch System Image
type: Class
subclass of: Modify System Image
attack-id: T1601.001
definition: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.

Downgrade System Image
type: Class
subclass of: Modify System Image
attack-id: T1601.002
definition: Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution)

Data from Configuration Repository
type: Class
subclass of: Collection Technique
attack-id: T1602
definition: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.

SNMP (MIB Dump)
type: Class
subclass of: Data from Configuration Repository
attack-id: T1602.001
definition: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

Network Device Configuration Dump
type: Class
subclass of: Data from Configuration Repository
attack-id: T1602.002
definition: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.

Forge Web Credentials
type: Class
subclass of: Credential Access Technique
attack-id: T1606
definition: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

Web Cookies
type: Class
subclass of: Forge Web Credentials
attack-id: T1606.001
definition: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.

SAML Tokens
type: Class
subclass of: Forge Web Credentials
attack-id: T1606.002
definition: An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps) The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.(Citation: Microsoft SAML Token Lifetimes) Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: Cyberark Golden SAML)

Stage Capabilities
type: Class
subclass of: Resource Development Technique
attack-id: T1608
definition: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)

Upload Malware
type: Class
subclass of: Stage Capabilities
attack-id: T1608.001
definition: Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.

Upload Tool
type: Class
subclass of: Stage Capabilities
attack-id: T1608.002
definition: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.

Install Digital Certificate
type: Class
subclass of: Stage Capabilities
attack-id: T1608.003
definition: Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert)

Drive-by Target
type: Class
subclass of: Stage Capabilities
attack-id: T1608.004
definition: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).

Link Target
type: Class
subclass of: Stage Capabilities
attack-id: T1608.005
definition: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link.

SEO Poisoning
type: Class
subclass of: Stage Capabilities
attack-id: T1608.006
definition: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SEO)

Container Administration Command
type: Class
subclass of: Execution Technique
attack-id: T1609
definition: Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)

Deploy Container
type: Class
subclass of: Defense Evasion Technique
subclass of: Execution Technique
attack-id: T1610
definition: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)

Escape to Host
type: Class
subclass of: Privilege Escalation Technique
attack-id: T1611
definition: Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)

Build Image on Host
type: Class
subclass of: Defense Evasion Technique
attack-id: T1612
definition: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)

Container and Resource Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1613
definition: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.

System Location Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: accesses
  some values from: Configuration Resource
type: NamedIndividual
accesses: Configuration Resource
attack-id: T1614

System Language Discovery
type: Class
subclass of: System Location Discovery
subclass of: Restriction
  on property: queries
  some values from: System Configuration Database
type: NamedIndividual
queries: System Configuration Database
attack-id: T1614.001
definition: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check)

Group Policy Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: reads
  some values from: Group Policy
type: NamedIndividual
reads: Group Policy
definition: Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)
attack-id: T1615

Cloud Storage Object Discovery
type: Class
subclass of: Discovery Technique
subclass of: Restriction
  on property: accesses
  some values from: Cloud Storage
type: NamedIndividual
accesses: Cloud Storage
definition: Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure.
attack-id: T1619

Reflective Code Loading
type: Class
subclass of: Defense Evasion Technique
subclass of: Restriction
  on property: modifies
  some values from: Process Segment
type: NamedIndividual
modifies: Process Segment
definition: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)).
attack-id: T1620

Multi-Factor Authentication Request Generation
type: Class
subclass of: Credential Access Technique
attack-id: T1621
definition: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

Debugger Evasion
type: Class
subclass of: Defense Evasion Technique
subclass of: Discovery Technique
attack-id: T1622
definition: Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.(Citation: ProcessHacker Github)

Plist File Modification
type: Class
subclass of: Defense Evasion Technique
attack-id: T1647
definition: Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.(Citation: fileinfo plist file description)

Serverless Execution
type: Class
subclass of: Execution Technique
attack-id: T1648
definition: Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.

Steal or Forge Authentication Certificates
type: Class
subclass of: Credential Access Technique
attack-id: T1649
definition: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Azure AD device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)

Acquire Access
type: Class
subclass of: Resource Development Technique
attack-id: T1650
definition: Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)(Citation: Krebs Access Brokers Fortune 500) In some cases, adversary groups may form partnerships to share compromised systems with each other.(Citation: CISA Karakurt 2022)

Cloud Administration Command
type: Class
subclass of: Execution Technique
attack-id: T1651
definition: Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. (Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command)

Device Driver Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1652
definition: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).

Power Settings
type: Class
subclass of: Persistence Technique
attack-id: T1653
definition: Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate)

Log Enumeration
type: Class
subclass of: Discovery Technique
attack-id: T1654
definition: Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)).

Impersonation
type: Class
subclass of: Defense Evasion Technique
attack-id: T1656
definition: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.

Financial Theft
type: Class
subclass of: Impact Technique
attack-id: T1657
definition: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) "pig butchering,"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin)

Content Injection
type: Class
subclass of: Command and Control Technique
subclass of: Initial Access Technique
attack-id: T1659
definition: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer)

Hide Infrastructure
type: Class
subclass of: Command and Control Technique
attack-id: T1665
definition: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished in various ways including by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely.

Modify Cloud Resource Hierarchy
type: Class
subclass of: Defense Evasion Technique
attack-id: T1666
definition: Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.

Email Bombing
type: Class
subclass of: Impact Technique
attack-id: T1667
definition: Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations.(Citation: sophos-bombing)(Citation: krebs-email-bombing)

Exclusive Control
type: Class
subclass of: Persistence Technique
attack-id: T1668
definition: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system.

Wi-Fi Networks
type: Class
subclass of: Initial Access Technique
attack-id: T1669
definition: Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks — requiring [Valid Accounts](https://attack.mitre.org/techniques/T1078) — belonging to a target organization.(Citation: DOJ GRU Charges 2018)(Citation: Nearest Neighbor Volexity) Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection.

Cloud Application Integration
type: Class
subclass of: Persistence Technique
attack-id: T1671
definition: Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.(Citation: Push Security SaaS Persistence 2022)(Citation: SaaS Attacks GitHub Evil Twin Integrations)

Email Spoofing
type: Class
subclass of: Defense Evasion Technique
attack-id: T1672
definition: Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.(Citation: Proofpoint TA427 April 2024) In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity.

Virtual Machine Discovery
type: Class
subclass of: Discovery Technique
attack-id: T1673
definition: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: TrendMicro Play) Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host.

Input Injection
type: Class
subclass of: Execution Technique
attack-id: T1674
definition: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs).

ESXi Administration Command
type: Class
subclass of: Execution Technique
attack-id: T1675
definition: Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as `vmtoolsd.exe` on Windows guest operating systems, `vmware-tools-daemon` on macOS, and `vmtoolsd ` on Linux.(Citation: Broadcom VMware Tools Services)

Initial Access
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to get into your network. Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.
display-order: 1

Execution
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.
display-order: 2

Persistence
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
display-order: 3
definition: The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

Privilege Escalation
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
display-order: 4
definition: The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level local administrator user account with admin-like access user accounts with access to specific system or perform specific function These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

Defense Evasion
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
display-order: 5
definition: The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

Credential Access
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
display-order: 6

Discovery
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
display-order: 7

Lateral Movement
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to move through your environment. Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target and subsequently gaining access to it. Reaching their objective often involves pivoting through multiple systems and accounts to gain. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.
display-order: 8

Collection
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to gather data of interest to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to either steal (exfiltrate) the data or to use the data to gain more information about the target environment. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.
display-order: 9

Exfiltration
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to steal data. Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they've collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.
display-order: 11

Command And Control
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.
display-order: 10

Impact
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
type: Offensive Tactic
definition: The adversary is trying to manipulate, interrupt, or destroy your systems and data. Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries' goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
display-order: 12

Resource Development
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
display-order: 0
definition: The adversary is trying to establish resources they can use to support operations. Resource Development consists of techniques that involve adversaries creating, purchasing, or compromising/stealing resources that can be used to support targeting. Such resources include infrastructure, accounts, or capabilities. These resources can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using purchased domains to support Command and Control, email accounts for phishing as a part of Initial Access, or stealing code signing certificates to help with Defense Evasion.

Reconnaissance
type: Class
subclass of: ATTACK Enterprise Tactic
subclass of: Offensive Tactic
type: NamedIndividual
display-order: -1
definition: The adversary is trying to gather information they can use to plan future operations. Reconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Such information may include details of the victim organization, infrastructure, or staff/personnel. This information can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using gathered information to plan and execute Initial Access, to scope and prioritize post-compromise objectives, or to drive and lead further Reconnaissance efforts.

TCP Event
type: Class
subclass of: TransportLayerEvent
definition: An event involving the Transmission Control Protocol (TCP), providing reliable, ordered, and error-checked delivery of data between applications.

TFTP Network Traffic
type: Class
subclass of: Network Traffic
type: NamedIndividual
definition: TFTP Network Traffic is network traffic typically used to automatically transfer configuration or boot files between machines.

TFTP Server
type: Class
subclass of: Server
definition: Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot files between machines. It is used where user authentication and directory visibility are not required.

TPM Boot Integrity
type: Class
subclass of: Platform Hardening
type: NamedIndividual
kb-reference: Reference-TrustedAttestationProtocolUseCases
d3fend-id: D3-TBI
synonym: STRM
kb-article: ## How it works During the boot process, the BIOS boot block (which with this defense enabled, is the Core Root of Trust for Measurement) measures boot components (firmware, ROM). The TPM hashes those measurements and stores the hashes in Platform Configuration Registers (PCRs). Upon a subsequent boot, these hashes are provided to a verifier which compares the stored measurements to the new boot measurements. Integrity of the boot components is assured if they match. Attestation of the secure boot occurs when a verifying entity requests a Quote which is a concatenation of the requested PCR values, hashed and signed by the TPM's unique RSA key. The TPM signature is trusted because the private key is stored securely in hardware and never leaves the TPM. ## Considerations * The TPM does not perform the follow-on actions of acting on the PCR value information, it just provides the PCR stored information. * The current version of TPM is 2.0.; most existing implementations use TPM 1.2. ## Citations [1] [TPM 2.0 Library](https://trustedcomputinggroup.org/resource/tpm-library-specification/) [2] [TCG Trusted Attestation Protocol (TAP) Use Cases for TPM Families 1.2 and 2.0 and DICE](https://trustedcomputinggroup.org/wp-content/uploads/TCG_TNC_TAP_Use_Cases_v1r0p35_published.pdf)
definition: Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
synonym: Static Root of Trust Measurement

Tablet Computer
type: Class
subclass of: Personal Computer
definition: A tablet computer, commonly shortened to tablet, is a mobile device, typically with a mobile operating system and touchscreen display processing circuitry, and a rechargeable battery in a single, thin and flat package. Tablets, being computers, do what other personal computers do, but lack some input/output (I/O) abilities that others have. Modern tablets largely resemble modern smartphones, the only differences being that tablets are relatively larger than smartphones, with screens 7 inches (18 cm) or larger, measured diagonally, and may not support access to a cellular network.
alternative label: Tablet

Target Audience
type: Class
subclass of: Agent Group

Technique
type: Class
subclass of: Plan

Technique Reference
type: Class
subclass of: D3FEND KB Thing
subclass of: Restriction
  on property: kb-reference-of
  some values from: Defensive Technique
subclass of: Restriction
  on property: has-link
  some values from: anyURI
subclass of: Restriction
  on property: kb-reference-title
  some values from: string
definition: A reference used to develop KB articles.
pref-label: Technique Reference

Temporal Difference Learning
type: Class
subclass of: Model-free Reinforcement Learning
type: NamedIndividual
d3fend-id: D3A-TDL
comment: Temporal difference (TD) learning refers to a class of model-free reinforcement learning methods which learn by bootstrapping from the current estimate of the value function.
definition: Temporal difference (TD) learning refers to a class of model-free reinforcement learning methods which learn by bootstrapping from the current estimate of the value function. These methods sample from the environment, like Monte Carlo methods, and perform updates based on current estimates, like dynamic programming methods
kb-article: ## References Temporal difference learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Temporal_difference_learning).

Temporal Logic
type: Class
subclass of: Modal Logic
type: NamedIndividual
d3fend-id: D3A-TL
definition: Temporal logic addresses the semantics of tense; i.e., qualifying expressions of when.
kb-article: ## References 1. Temporal logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Temporal_logic)

Terminate Process
type: Class
subclass of: System Call
subclass of: Restriction
  on property: terminates
  some values from: Process
type: NamedIndividual
terminates: Process
definition: On many computer operating systems, a computer process terminates its execution by making an exit system call. More generally, an exit in a multithreading environment means that a thread of execution has stopped running. For resource management, the operating system reclaims resources (memory, files, etc.) that were used by the process. The process is said to be a dead process after it terminates.

Tertiary Storage
type: Class
subclass of: Hardware Device
subclass of: Secondary Storage
definition: Tertiary storage or tertiary memory is memory primarily used for archiving rarely accessed information. It is primarily useful for extraordinarily large data stores. Typical examples include tape libraries and optical jukeboxes.

Test Execution Tool
type: Class
subclass of: Developer Application
definition: A test execution tool is a type of software used to test software, hardware or complete systems. Synonyms of test execution tool include test execution engine, test executive, test manager, test sequencer. Two common forms in which a test execution engine may appear are as a: (a) module of a test software suite (test bench) or an integrated development environment, or (b) stand-alone application software.
alternative label: Test Execution Engine
alternative label: Test Executive
alternative label: Test Manager

Thin Client Computer
type: Class
subclass of: Shared Computer
definition: A thin client is a lightweight computer that has been optimized for establishing a remote connection with a server-based computing environment. The server does most of the work, which can include launching software programs, performing calculations, and storing data. This contrasts with a fat client or a conventional personal computer; the former is also intended for working in a client-server model but has significant local processing power, while the latter aims to perform its function mostly locally. Thin clients are shared computers as the thin client's computing resources are provided by a remote server.

Thread
type: Class
subclass of: Digital Information Bearer
type: NamedIndividual
definition: A Thread is the smallest unit of execution within a process, representing a sequence of instructions that can be scheduled and executed independently by the operating system.

Thread Start Function
type: Class
subclass of: Subroutine
subclass of: Restriction
  on property: executes
  some values from: Thread
type: NamedIndividual
executes: Thread
definition: A function which invokes a create thread system call.

Ticket Granting Ticket
type: Class
subclass of: Access Token
definition: In some computer security systems, a Ticket Granting Ticket or Ticket to Get Tickets (TGT) is a small, encrypted identification file with a limited validity period. After authentication, this file is granted to a user for data traffic protection by the key distribution center (KDC) subsystem of authentication services such as Kerberos. The TGT file contains the session key, its expiration date, and the user's IP address, which protects the user from man-in-the-middle attacks. The TGT is used to obtain a service ticket from Ticket Granting Service (TGS). User is granted access to network services only after this service ticket is provided.
alternative label: Golden Ticket

Time Series Analysis
type: Class
subclass of: Statistical Method
type: NamedIndividual
d3fend-id: D3A-TSA
kb-article: ## References Wikipedia. (n.d.). Time series. [Link](https://en.wikipedia.org/wiki/Time_series)
definition: Time series analysis comprises methods for analyzing time series data in order to extract meaningful statistics and other characteristics of the data.

Token-based Authentication
type: Class
subclass of: Agent Authentication
subclass of: Restriction
  on property: uses
  some values from: Access Token
type: NamedIndividual
kb-reference: Reference-Entrust-What-Is-Token-Based-Authentication
uses: Access Token
d3fend-id: D3-TBA
definition: Token-based authentication is an authentication protocol where users verify their identity in exchange for a unique access token. Users can then access the website, application, or resource for the life of the token without having to re-enter their credentials.
kb-article: ## How it works Token-based authentication starts with a user logging into a system, device or application, typically using a password or a security question. An authorization server validates that initial authentication and then issues an access token, which is a small piece of data that lets a client application make a secure call or signal to an API server. Once this initial token-based authentication protocol is completed, the token works like a stamped ticket: The user can continue to seamlessly access the relevant resources, without re-authenticating, for the duration of the token lifecycle. That lifecycle ends when the user logs out or quits an app — and can also be triggered by a set time-out protocol. ## Considerations: While token-based authentication is undoubtedly a major step above traditional password-based authentication, the token is still considered a “bearer token” — that is, access is granted to whomever holds the token.

Token Binding
type: Class
subclass of: Credential Hardening
subclass of: Restriction
  on property: strengthens
  some values from: Access Token
type: NamedIndividual
strengthens: Access Token
d3fend-id: D3-TB
kb-article: ## How it works When issuing a security token to a client that supports Token Binding, a server includes the client's Token Binding ID (or its cryptographic hash) in the token. Later on, when a client presents a security token containing a Token Binding ID, the server verifies that the ID in the token matches the ID of the Token Binding established with the client. In the case of a mismatch, the server rejects the token. ## Considerations - While industry participation in the standards process is widespread, browser support remains limited. - In practice, token-binding implementations are tied to Transport Security Layer (TLS).
definition: Token binding is a security mechanism used to enhance the protection of tokens, such as cookies or OAuth tokens, by binding them to a specific connection.

Trace Process
type: Class
subclass of: System Call
subclass of: Restriction
  on property: monitors
  some values from: Process
type: NamedIndividual
monitors: Process
definition: A trace system call provides a means by which one process (the "tracer") may observe and control the execution of another process (the "tracee"), and examine and change the tracee's memory and registers. It is primarily used to implement breakpoint debugging and system call tracing.
alternative label: Open Process

Trace Thread
type: Class
subclass of: System Call
type: NamedIndividual

Trajectory Prediction
type: Class
subclass of: Forecasting

Transducer Sensor
type: Class
subclass of: Sensor
definition: A Transducer Sensor converts physical signals into digital data for monitoring purposes.

Transfer Agent Authentication
type: Class
subclass of: Message Hardening
type: NamedIndividual
kb-reference: Reference-DomainKeysIdentifiedMail-Signatures-IETF
kb-reference: Reference-RFC7208-SenderPolicyFramework-SPF-ForAuthorizingUseOfDomainsInEmail-IETF
kb-reference: Reference-RFC7489-Domain-basedMessageAuthentication-Reporting-AndConformance-DMARC
d3fend-id: D3-TAAN
kb-article: ## How it works Transfer Agent Authentication can be accomplished in different ways for depending on the protocol. In Email, Sender Policy Framework (SPF), Domain Key Identified Email (DKIM) or Domain-based Message Authentication Reporting and Conformance (DMARC) are used to validate sender domain ownership. ### SPF SPF protocol allows for mail domain owners to specify the mail servers they use when sending email. SPF requires the use of SPF records published in the Domain Name System (DNS). The records record the authorized IPs for email senders. SPF uses the return-path address for domain IP identification. Email that is forwarded may cause the return-path validation problems. ### DKIM DKIM also uses a record entry in DNS for authentication but does not rely on the simple return-path for validation. A signature header is added to email and encryption is used for security. This adds an additional layer of complexity and requires that DKIM servers be configured identified cryptographic signatures. The additional complexity results in a validation process that can survive complex routing of emails. ### DMARC DMARC is an email policy and authentication protocol that seeks to ensure that the "From" field of emails is not spoofed. DMARC makes use of both SPF records and DKIM published key validation. DMARC also has a decision policy framework, contained in a DMARC record, for handling of rejected email. The DMARC framework also updates DMARC domains with authentication statues for allowed senders of that domain. ## Considerations - Additional work is required to ensure that all SPF, DKIM and DMARC records are current and up to date. - Maintenance of DKIM signing keys is needed. - Using SPF without DKIM and DMARC verifies the Return-Path domain however does not prevent spoofing of the displayed From: address. - Parts of an email that are not signed or verified by email authentication methods, such as the message body or the header To: and Subject: fields, can be altered …
definition: Validating that server components of a messaging infrastructure are authorized to send a particular message.

Transfer Learning
type: Class
subclass of: Machine Learning
type: NamedIndividual
d3fend-id: D3A-TL
definition: Transfer learning (TL) is a research problem in machine learning (ML) that focuses on storing knowledge gained while solving one problem and applying it to a different but related problem.
kb-article: ## References Transfer learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Transfer_learning).

Transformer-XL
type: Class
subclass of: Transformer-basedLearning
type: NamedIndividual
d3fend-id: D3A-TX
kb-article: ## References Transformer-XL. (n.d.). Papers with Code. [Link](https://paperswithcode.com/method/transformer-xl)
definition: Transformer-XL is a transformer architecture that introduces the notion of recurrence to the deep self-attention network. Instead of computing the hidden states from scratch for each new segment, Transformer-XL reuses the hidden states obtained in previous segments.