D3FEND 防御知识库
技术列表 · 只读官方知识数据
D3FEND 标识技术名称战术父技术子技术ATT&CK
D3-EALExecutable AllowlistingUsing a digital signature to authenticate a file before opening.IsolateExecutionIsolation058D3-EDLExecutable DenylistingBlocking the execution of files on a host in accordance with defined application policy rules.IsolateExecutionIsolation058D3-EIExecution IsolationExecution Isolation techniques prevent application processes from accessing non-essential system resources, such as memory, devices, or files.Isolate--50D3-FAPAFile Access Pattern AnalysisAnalyzing the files accessed by a process to identify unauthorized activity.DetectProcessAnalysis00D3-FAFile AnalysisFile Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.Detect--4110D3-FCFile CarvingIdentifying and extracting files from network application protocols through the use of network stream reassembly software.DetectNetworkTrafficAnalysis02D3-FCOAFile Content AnalysisEmploying a pattern matching algorithm to statically analyze the content of files.DetectFileAnalysis10D3-FCDCFile Content Decompression CheckingChecking if compressed or encoded data sections can be successfully decompressed or decoded. Can follow with further analysis with semantic knowledgeIsolateFileFormatVerification00D3-FCRFile Content RulesEmploying a pattern matching rule language to analyze the content of files.DetectFileContentAnalysis00D3-FCAFile Creation AnalysisAnalyzing the properties of file create system call invocations.DetectSystemCallAnalysis02D3-FEFile EncryptionEncrypting a file using a cryptographic key.HardenPlatformHardening0110D3-FEVFile EvictionFile eviction techniques delete files from system storage.EvictObjectEviction1110D3-FFVFile Format VerificationVerifying that a file conforms to its expected format specificationsIsolateContentValidation41D3-FHRAFile Hash Reputation AnalysisAnalyzing the reputation of a file hash.DetectIdentifierReputationAnalysis00D3-FHFile HashingEmploying file hash comparisons to detect known malware.DetectFileAnalysis00D3-FIMFile Integrity MonitoringDetecting any suspicious changes to files in a computer system.DetectPlatformMonitoring0110D3-FISVFile Internal Structure VerificationThe process of checking specific static values within a file, such as file signatures or magic numbers, to ensure they match the expected values defined by the file format specification.IsolateFileFormatVerification00D3-FMBVFile Magic Byte VerificationUtilizing the magic number to verify the fileIsolateFileMetadataValueVerification00D3-FMCVFile Metadata Consistency ValidationThe process of validating the consistency between a file's metadata and its actual content, ensuring that elements like declared lengths, pointers, and checksums accurately describe the file's content.IsolateFileFormatVerification00D3-FMVVFile Metadata Value VerificationThe process of checking specific static values within a file, such as file signatures or magic numbers, to ensure they match the expected values defined by the file format specification.IsolateFileFormatVerification10D3-FBAFirmware Behavior AnalysisAnalyzing the behavior of embedded code in firmware and looking for anomalous behavior and suspicious activity.DetectPlatformMonitoring08D3-FEMCFirmware Embedded Monitoring CodeMonitoring code is injected into firmware for integrity monitoring of firmware and firmware data.DetectPlatformMonitoring08D3-FVFirmware VerificationCryptographically verifying firmware integrity.DetectPlatformMonitoring28D3-FRDDLForward Resolution Domain DenylistingBlocking a lookup based on the query's domain name value.IsolateDNSDenylisting22D3-FRIDLForward Resolution IP DenylistingBlocking a DNS lookup's answer's IP address value.IsolateDNSDenylisting00D3-HCIHardware Component InventoryHardware component inventorying identifies and records the hardware items in the organization's architecture.ModelAssetInventory021D3-HBPIHardware-based Process IsolationPreventing one process from writing to the memory space of another process through hardware based address manager implementations.IsolateExecutionIsolation048D3-HBWPHardware-based Write ProtectionPhysical methods of preventing data from being written to computer storage.HardenPlatformHardening02D3-HDDLHierarchical Domain DenylistingBlocking the resolution of any subdomain of a specified domain name.IsolateForwardResolutionDomainDenylisting00D3-HDLHomoglyph DenylistingBlocking DNS queries that are deceptively similar to legitimate domain names.IsolateForwardResolutionDomainDenylisting00