D3FEND 技术详情

D3-FEV

File Eviction

驱逐

定义

File eviction techniques delete files from system storage.

父技术

D3-OEObject Eviction

子技术

D3-EREmail Removal

关联构件

File

A file maintained in computer-readable form.

语义关系

出向deletesFile

出向kb referenceReference - How Does Antivirus Quarantine Work? - Safety Detectives

关联 ATT&CK

110

DE-0007Evasion via Rootkit

Evict · Object Eviction

Kernel Module modifies File · deletes

EX-0010.02Wiper Malware

Evict · Object Eviction

File modifies File · deletes

EX-0010.03Rootkit

Evict · Object Eviction

Kernel Module modifies File · deletes

T0851Rootkit

Evict · Object Eviction

Kernel Module may-modify File · deletes

Evict · Object Eviction

Shared Library File may-modify File · deletes

T0853Scripting

Evict · Object Eviction

Executable Script executes File · deletes

T0865Spearphishing Attachment

Evict · Object Eviction

Email produces File · deletes

T0871Execution through API

Evict · Object Eviction

Executable Script executes File · deletes

T0888Remote System Information Discovery

Evict · Object Eviction

Operating System Configuration File may-access File · deletes

T0893Data from Local System

Evict · Object Eviction

Configuration File may-access File · deletes

Evict · Object Eviction

Database File may-access File · deletes

T0894System Binary Proxy Execution

Evict · Object Eviction

Executable Script executes File · deletes

Evict · Object Eviction

Shared Library File loads File · deletes

T0895Autorun Image

Evict · Object Eviction

Executable Script executes File · deletes

T1003.007Proc Filesystem

Evict · Object Eviction

Operating System File accesses File · deletes

T1003.008/etc/passwd and /etc/shadow

Evict · Object Eviction

Password File accesses File · deletes

T1005Data from Local System

Evict · Object Eviction

File accesses File · deletes

T1014Rootkit

Evict · Object Eviction

Shared Library File may-modify File · deletes

Evict · Object Eviction

Kernel Module may-modify File · deletes

T1016System Network Configuration Discovery

Evict · Object Eviction

Executable Script may-execute File · deletes

T1018Remote System Discovery

Evict · Object Eviction

Operating System Configuration File may-access File · deletes

T1027.001Binary Padding

Evict · Object Eviction

Executable Binary modifies File · deletes

T1027.002Software Packing

Evict · Object Eviction

Executable File obfuscates File · deletes

T1027.004Compile After Delivery

Evict · Object Eviction

Executable File creates File · deletes

T1033System Owner/User Discovery

Evict · Object Eviction

Password File may-access File · deletes

T1036.001Invalid Code Signature

Evict · Object Eviction

Executable Binary creates File · deletes

T1036.003Rename Legitimate Utilities

Evict · Object Eviction

Executable File may-create File · deletes

Evict · Object Eviction

Operating System Executable File may-modify File · deletes

T1036.005Match Legitimate Resource Name or Location

Evict · Object Eviction

File may-create File · deletes

T1036.006Space after Filename

Evict · Object Eviction

File creates File · deletes

T1037.001Logon Script (Windows)

Evict · Object Eviction

User Init Script modifies File · deletes

T1037.002Login Hook

Evict · Object Eviction

User Init Script modifies File · deletes

T1037.003Network Logon Script

Evict · Object Eviction

Network Init Script File Resource modifies File · deletes

T1037.004RC Scripts

Evict · Object Eviction

System Init Script modifies File · deletes

T1041Exfiltration Over C2 Channel

Evict · Object Eviction

Certificate File may-transfer File · deletes

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Evict · Object Eviction

Certificate File may-transfer File · deletes

T1053.004Launchd

Evict · Object Eviction

Property List File creates File · deletes

T1055.001Dynamic-link Library Injection

Evict · Object Eviction

Shared Library File adds File · deletes

Evict · Object Eviction

Shared Library File loads File · deletes

T1055.002Portable Executable Injection

Evict · Object Eviction

Object File may-add File · deletes

T1055.003Thread Execution Hijacking

Evict · Object Eviction

Executable Binary may-add File · deletes

T1055.009Proc Memory

Evict · Object Eviction

Operating System File accesses File · deletes

Evict · Object Eviction

Operating System File may-modify File · deletes

T1055.014VDSO Hijacking

Evict · Object Eviction

Shared Library File accesses File · deletes

T1059Command and Scripting Interpreter

Evict · Object Eviction

Executable Script executes File · deletes

T1070.002Clear Linux or Mac System Logs

Evict · Object Eviction

Operating System Log File modifies File · deletes

T1070.004File Deletion

Evict · Object Eviction

File may-modify File · deletes

Evict · Object Eviction

File deletes File · deletes

T1071Application Layer Protocol

Evict · Object Eviction

Certificate File may-transfer File · deletes

T1071.001Web Protocols

Evict · Object Eviction

Certificate File may-transfer File · deletes

T1072Software Deployment Tools

Evict · Object Eviction

File adds File · deletes

T1074.001Local Data Staging

Evict · Object Eviction

File may-create File · deletes

T1083File and Directory Discovery

Evict · Object Eviction

File accesses File · deletes

T1114.001Local Email Collection

Evict · Object Eviction

Email reads File · deletes

T1119Automated Collection

Evict · Object Eviction

File accesses File · deletes

T1127.001MSBuild

Evict · Object Eviction

Compiler Configuration File modifies File · deletes

T1137.001Office Template Macros

Evict · Object Eviction

Executable Script may-modify File · deletes

Evict · Object Eviction

Executable Script may-add File · deletes

T1137.003Outlook Forms

Evict · Object Eviction

Office Application File adds File · deletes

T1140Deobfuscate/Decode Files or Information

Evict · Object Eviction

Executable File may-add File · deletes

T1187Forced Authentication

Evict · Object Eviction

Windows Shortcut File may-modify File · deletes

T1204.002Malicious File

Evict · Object Eviction

Executable File executes File · deletes

T1218.005Mshta

Evict · Object Eviction

Microsoft HTML Application interprets File · deletes

T1218.011Rundll32

Evict · Object Eviction

Shared Library File loads File · deletes

T1220XSL Script Processing

Evict · Object Eviction

Executable Script interprets File · deletes

Evict · Object Eviction

File adds File · deletes

T1486Data Encrypted for Impact

Evict · Object Eviction

File encrypts File · deletes

T1505.003Web Shell

Evict · Object Eviction

Web Script File adds File · deletes

T1534Internal Spearphishing

Evict · Object Eviction

Email produces File · deletes

T1543.001Launch Agent

Evict · Object Eviction

Property List File creates File · deletes

T1543.002Systemd Service

Evict · Object Eviction

Operating System Configuration File may-modify File · deletes

Evict · Object Eviction

Operating System Configuration File may-create File · deletes

T1543.004Launch Daemon

Evict · Object Eviction

Property List File modifies File · deletes

T1546.002Screensaver

Evict · Object Eviction

Executable File creates File · deletes

T1546.004Unix Shell Configuration Modification

Evict · Object Eviction

User Init Configuration File modifies File · deletes

T1546.005Trap

Evict · Object Eviction

Executable Script may-create File · deletes

Evict · Object Eviction

Executable Script may-modify File · deletes

T1546.006LC_LOAD_DYLIB Addition

Evict · Object Eviction

Executable Binary modifies File · deletes

T1546.008Accessibility Features

Evict · Object Eviction

Executable Binary may-modify File · deletes

T1546.009AppCert DLLs

Evict · Object Eviction

Shared Library File loads File · deletes

T1546.010AppInit DLLs

Evict · Object Eviction

Shared Library File loads File · deletes

T1546.013PowerShell Profile

Evict · Object Eviction

PowerShell Profile Script modifies File · deletes

T1546.014Emond

Evict · Object Eviction

Property List File may-create File · deletes

Evict · Object Eviction

Property List File may-modify File · deletes

T1546.015Component Object Model Hijacking

Evict · Object Eviction

Executable Binary loads File · deletes

T1547.001Registry Run Keys / Startup Folder

Evict · Object Eviction

User Startup Script File may-modify File · deletes

T1547.006Kernel Modules and Extensions

Evict · Object Eviction

Kernel Module modifies File · deletes

T1547.007Re-opened Applications

Evict · Object Eviction

Application Configuration File modifies File · deletes

T1547.008LSASS Driver

Evict · Object Eviction

Shared Library File may-create File · deletes

T1547.009Shortcut Modification

Evict · Object Eviction

User Startup Script File may-modify File · deletes

Evict · Object Eviction

Symbolic Link may-modify File · deletes

T1547.011Plist Modification

Evict · Object Eviction

Application Configuration File modifies File · deletes

T1548.002Bypass User Account Control

Evict · Object Eviction

Executable File executes File · deletes

T1548.003Sudo and Sudo Caching

Evict · Object Eviction

Operating System Configuration File modifies File · deletes

T1552.001Credentials In Files

Evict · Object Eviction

File accesses File · deletes

T1552.003Shell History

Evict · Object Eviction

Command History Log File accesses File · deletes

T1555Credentials from Password Stores

Evict · Object Eviction

Database File may-access File · deletes

T1555.003Credentials from Web Browsers

Evict · Object Eviction

Database File accesses File · deletes

T1556.002Password Filter DLL

Evict · Object Eviction

Shared Library File creates File · deletes

T1556.003Pluggable Authentication Modules

Evict · Object Eviction

Operating System Shared Library File may-modify File · deletes

Evict · Object Eviction

Operating System Configuration File may-modify File · deletes

T1560Archive Collected Data

Evict · Object Eviction

Archive File creates File · deletes

T1560.001Archive via Utility

Evict · Object Eviction

Archive File creates File · deletes

T1560.002Archive via Library

Evict · Object Eviction

Archive File creates File · deletes

T1560.003Archive via Custom Method

Evict · Object Eviction

Custom Archive File creates File · deletes

T1562.003Impair Command History Logging

Evict · Object Eviction

User Init Script may-modify File · deletes

T1564.002Hidden Users

Evict · Object Eviction

User Init Configuration File modifies File · deletes

T1564.003Hidden Window

Evict · Object Eviction

Property List File may-modify File · deletes

T1564.006Run Virtual Instance

Evict · Object Eviction

File creates File · deletes

T1564.007VBA Stomping

Evict · Object Eviction

Office Application File modifies File · deletes

T1565.001Stored Data Manipulation

Evict · Object Eviction

File modifies File · deletes

T1565.003Runtime Data Manipulation

Evict · Object Eviction

Executable File may-modify File · deletes

T1566.001Spearphishing Attachment

Evict · Object Eviction

Email produces File · deletes

T1566.002Spearphishing Link

Evict · Object Eviction

Email produces File · deletes

T1566.003Spearphishing via Service

Evict · Object Eviction

File produces File · deletes

T1573.002Asymmetric Cryptography

Evict · Object Eviction

Certificate File may-transfer File · deletes

T1574.001DLL

Evict · Object Eviction

Shared Library File may-create File · deletes

T1574.002DLL Side-Loading

Evict · Object Eviction

Shared Library File may-modify File · deletes

Evict · Object Eviction

Shared Library File may-create File · deletes

T1574.004Dylib Hijacking

Evict · Object Eviction

Shared Library File may-create File · deletes

Evict · Object Eviction

Shared Library File may-modify File · deletes

T1574.006Dynamic Linker Hijacking

Evict · Object Eviction

Operating System Configuration File modifies File · deletes

T1574.007Path Interception by PATH Environment Variable

Evict · Object Eviction

Executable File creates File · deletes

T1574.008Path Interception by Search Order Hijacking

Evict · Object Eviction

Executable File creates File · deletes

T1574.009Path Interception by Unquoted Path

Evict · Object Eviction

Executable File creates File · deletes

T1574.012COR_PROFILER

Evict · Object Eviction

Shared Library File adds File · deletes

T1649Steal or Forge Authentication Certificates

Evict · Object Eviction

Certificate File accesses File · deletes

查看关系图在矩阵中定位