D3FEND 技术详情
D3-SCA
定义
Analyzing system calls to determine whether a process is exhibiting unauthorized behavior.
父技术
子技术
关联构件
SystemCall
System Call
A system call is the programmatic way in which a computer program requests a service from the kernel of the operating system it is executed on. This may include hardware-related services (for example, accessing a hard disk drive), creation and execution of new processes, and communication with integral kernel services such as process scheduling. System calls provide an essential interface between a process and the operating system.
语义关系
出向analyzesSystem Call
出向kb referenceReference - CAR-2020-05-001: MiniDump of LSASS - MITRE
出向kb referenceReference - CAR-2021-05-011: Create Remote Thread into LSASS - MITRE
出向kb referenceReference - CAR-2019-08-001: Credential Dumping via Windows Task Manager - MITRE
出向kb referenceReference - CAR-2013-10-002: DLL Injection via Load Library - MITRE
出向kb referenceReference - Deterministic method for detecting and blocking of exploits on interpreted code - K2 Cyber Security Inc
出向kb referenceReference - Hardware-assisted system and method for detecting and analyzing system calls made to an operting system kernel - Endgame Inc
出向kb referenceReference - Malware detection in event loops - Crowdstrike Inc
出向kb referenceReference - Post sandbox methods and systems for detecting and blocking zero-day exploits via api call validation - K2 Cyber Security Inc