DS0009 Process
Instances of computer programs that are being executed by at least one thread. Processes have memory space for process executables, loaded modules (DLLs or shared libraries), and allocated memory regions containing everything from user input to application-specific data structures1
| Item | Value |
|---|---|
| ID | DS0009 |
| Platforms | Android, Linux, Windows, iOS, macOS |
| Collection Layers | Host |
| Version | 1.1 |
| Created | 20 October 2021 |
| Last Modified | 20 April 2023 |
Data Components
OS API Execution
Operating system function/method calls executed by a process
Process Access
Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
| Domain | ID | Name |
|---|---|---|
| enterprise | T1185 | Browser Session Hijacking |
| enterprise | T1555 | Credentials from Password Stores |
| enterprise | T1555.002 | Securityd Memory |
| enterprise | T1555.003 | Credentials from Web Browsers |
| enterprise | T1555.005 | Password Managers |
| enterprise | T1559 | Inter-Process Communication |
| enterprise | T1559.003 | XPC Services |
| enterprise | T1556 | Modify Authentication Process |
| enterprise | T1556.001 | Domain Controller Authentication |
| enterprise | T1003 | OS Credential Dumping |
| enterprise | T1003.001 | LSASS Memory |
| enterprise | T1055 | Process Injection |
| enterprise | T1055.001 | Dynamic-link Library Injection |
| enterprise | T1055.002 | Portable Executable Injection |
| enterprise | T1055.003 | Thread Execution Hijacking |
| enterprise | T1055.004 | Asynchronous Procedure Call |
| enterprise | T1055.005 | Thread Local Storage |
| enterprise | T1055.008 | Ptrace System Calls |
| enterprise | T1055.012 | Process Hollowing |
| enterprise | T1539 | Steal Web Session Cookie |
| enterprise | T1033 | System Owner/User Discovery |
Process Creation
The initial construction of an executable managed by the OS, that may involve one or more tasks or threads. (e.g. Win EID 4688, Sysmon EID 1, cmd.exe > net use, etc.)
Process Metadata
Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
| Domain | ID | Name |
|---|---|---|
| enterprise | T1548 | Abuse Elevation Control Mechanism |
| enterprise | T1548.002 | Bypass User Account Control |
| enterprise | T1548.003 | Sudo and Sudo Caching |
| enterprise | T1134 | Access Token Manipulation |
| enterprise | T1134.004 | Parent PID Spoofing |
| enterprise | T1059 | Command and Scripting Interpreter |
| enterprise | T1059.001 | PowerShell |
| mobile | T1623 | Command and Scripting Interpreter |
| mobile | T1623.001 | Unix Shell |
| ics | T0874 | Hooking |
| enterprise | T1562 | Impair Defenses |
| enterprise | T1562.010 | Downgrade Attack |
| enterprise | T1056 | Input Capture |
| enterprise | T1056.004 | Credential API Hooking |
| enterprise | T1036 | Masquerading |
| enterprise | T1036.003 | Rename System Utilities |
| enterprise | T1036.005 | Match Legitimate Name or Location |
| ics | T0849 | Masquerading |
| enterprise | T1055 | Process Injection |
| enterprise | T1055.001 | Dynamic-link Library Injection |
| ics | T0853 | Scripting |
Process Modification
Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
| Domain | ID | Name |
|---|---|---|
| enterprise | T1185 | Browser Session Hijacking |
| enterprise | T1055 | Process Injection |
| enterprise | T1055.001 | Dynamic-link Library Injection |
| enterprise | T1055.002 | Portable Executable Injection |
| enterprise | T1055.003 | Thread Execution Hijacking |
| enterprise | T1055.004 | Asynchronous Procedure Call |
| enterprise | T1055.005 | Thread Local Storage |
| enterprise | T1055.008 | Ptrace System Calls |
| enterprise | T1055.012 | Process Hollowing |
| enterprise | T1055.015 | ListPlanting |
Process Termination
Exit of a running process (ex: Sysmon EID 5 or Windows EID 4689)
| Domain | ID | Name |
|---|---|---|
| ics | T0803 | Block Command Message |
| ics | T0804 | Block Reporting Message |
| ics | T0805 | Block Serial COM |
| enterprise | T1562 | Impair Defenses |
| enterprise | T1562.001 | Disable or Modify Tools |
| mobile | T1629 | Impair Defenses |
| enterprise | T1489 | Service Stop |
| ics | T0881 | Service Stop |
References
-
Microsoft. (2018, May 31). Processes and Threads. Retrieved September 28, 2021. ↩
-
Graeber, M. (2017, December 22). Code Signing Certificate Cloning Attacks and Defenses. Retrieved April 3, 2018. ↩
-
Russinovich, M. et al.. (2017, May 22). Sigcheck. Retrieved April 3, 2018. ↩
-
Microsoft. (2021, February 15). Enable Loading of Test Signed Drivers. Retrieved April 22, 2021. ↩
-
Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020. ↩
-
Mathers, B. (2017, May 31). Windows Time Service Tools and Settings. Retrieved March 26, 2018. ↩
-
Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016. ↩
-
Sarah Edwards. (2020, April 30). Analysis of Apple Unified Logs: Quarantine Edition [Entry 6] – Working From Home? Remote Logins. Retrieved August 19, 2021. ↩
-
Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019. ↩
-
Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017. ↩
-
Brown, J. (2020, May 7). Detecting COR_PROFILER manipulation for persistence. Retrieved June 24, 2020. ↩
-
Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015. ↩
-
NSA Cybersecurity Directorate. (n.d.). Mitigating Web Shells. Retrieved July 22, 2021. ↩
-
Desimone, J. (2018, April 18). Status Update. Retrieved July 3, 2018. ↩
-
Daman, R. (2020, February 4). The return of the spoof part 2: Command line spoofing. Retrieved November 19, 2021. ↩
-
Pena, E., Erikson, C. (2019, October 10). Staying Hidden on the Endpoint: Evading Detection with Shellcode. Retrieved November 29, 2021. ↩
-
Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018. ↩
-
Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018. ↩
-
Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017. ↩
-
Adrien Bataille, Anders Vejlby, Jared Scott Wilson, and Nader Zaveri. (2021, December 14). Azure Run Command for Dummies. Retrieved March 13, 2023. ↩
-
Jamie Harries. (2022, May 25). Hunting a Global Telecommunications Threat: DecisiveArchitect and Its Custom Implant JustForFun. Retrieved October 18, 2022. ↩
-
Mercês, F. (2014, January 27). CPL Malware - Malicious Control Panel Items. Retrieved January 18, 2018. ↩
-
Pierce, Sean. (2015, November). Defending Against Malicious Application Compatibility Shims. Retrieved June 22, 2017. ↩
-
Chrome Enterprise and Education Help. (n.d.). Use Chrome Browser with Roaming User Profiles. Retrieved March 28, 2023. ↩
-
Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018. ↩
-
Arntz, P. (2016, March 30). The Windows Vault . Retrieved November 23, 2020. ↩
-
Moe, O. (2017, August 13). Bypassing Device guard UMCI using CHM – CVE-2017-8625. Retrieved October 3, 2018. ↩
-
Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO). Retrieved December 18, 2017. ↩
-
Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017. ↩
-
Microsoft. (n.d.). Domain.GetAllTrustRelationships Method. Retrieved February 14, 2019. ↩
-
Schroeder, W. (2017, October 30). A Guide to Attacking Domain Trusts. Retrieved February 14, 2019. ↩
-
Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth look into keyloggers on Windows. Retrieved April 27, 2016. ↩
-
Pinola, M. (2014, December 14). 3 tools to check your hard drive’s health and make sure it’s not already dying on you. Retrieved October 2, 2018. ↩
-
Liberman, T. & Kogan, E. (2017, December 7). Lost in Transaction: Process Doppelgänging. Retrieved December 20, 2017. ↩
-
hasherezade. (2017, December 18). Process Doppelgänging – a new way to impersonate a process. Retrieved December 20, 2017. ↩
-
Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense against user-land. Retrieved December 12, 2017. ↩
-
Felici, M. (2006, December 6). Any application-defined hook procedure on my machine?. Retrieved December 12, 2017. ↩
-
Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017. ↩
-
Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017. ↩
-
Satiro, J. (2011, September 14). GetHooks. Retrieved December 12, 2017. ↩
-
Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017. ↩
-
Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018. ↩
-
Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018. ↩
-
Russinovich, M. & Sharkey, K. (2016, July 4). RegDelNull v1.11. Retrieved August 10, 2018. ↩
-
Microsoft. (n.d.). AddMonitor function. Retrieved November 12, 2014. ↩
-
0x00pico. (2017, September 25). Super-Stealthy Droppers. Retrieved October 4, 2021. ↩
-
Landry, J. (2016, April 21). Teaching an old RAT new tricks. Retrieved October 4, 2021. ↩
-
SanDisk. (n.d.). Self-Monitoring, Analysis and Reporting Technology (S.M.A.R.T.). Retrieved October 2, 2018. ↩
-
smartmontools. (n.d.). smartmontools. Retrieved October 2, 2018. ↩
-
Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. ↩
-
Brennan, M. (2022, February 16). Hackers No Hashing: Randomizing API Hashes to Evade Cobalt Strike Shellcode Detection. Retrieved August 22, 2022. ↩
-
Schofield, M. & Satran, M. (2018, May 30). Process Creation Flags. Retrieved June 4, 2019. ↩
-
Secuirtyinbits . (2019, May 14). Parent PID Spoofing (Stage 2) Ataware Ransomware Part 3. Retrieved June 6, 2019. ↩
-
GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved December 20, 2017. ↩
-
Jahoda, M. et al.. (2017, March 14). redhat Security Guide - Chapter 7 - System Auditing. Retrieved December 20, 2017. ↩
-
Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved December 20, 2017. ↩
-
stderr. (2014, February 14). Detecting Userland Preload Rootkits. Retrieved December 20, 2017. ↩
-
Microsoft. (2018, December 5). CredEnumarateA function (wincred.h). Retrieved November 24, 2020. ↩
-
Delpy, B. (2017, December 12). howto ~ credential manager saved credentials. Retrieved November 23, 2020. ↩
-
FBI. (2020, November 19). Indicators of Compromise Associated with Ragnar Locker Ransomware. Retrieved April 1, 2021. ↩
-
Microsoft. (n.d.). GetWindowLong function. Retrieved December 16, 2017. ↩
-
Microsoft. (n.d.). SetWindowLong function. Retrieved December 16, 2017. ↩
-
Microsoft. (n.d.). SendNotifyMessage function. Retrieved December 16, 2017. ↩
-
Microsoft. (n.d.). Graphics.CopyFromScreen Method. Retrieved March 24, 2020. ↩
-
Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017. ↩
-
Microsoft. (2021, October 21). NPLogonNotify function (npapi.h). Retrieved March 30, 2023. ↩
-
Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis. Retrieved April 8, 2019. ↩
-
Moe, O. (2018, January 14). Putting Data in Alternate Data Streams and How to Execute It. Retrieved June 30, 2018. ↩
-
Moe, O. (2018, April 11). Putting Data in Alternate Data Streams and How to Execute It - Part 2. Retrieved June 30, 2018. ↩
-
Atkinson, J. (2017, July 18). Host-based Threat Modeling & Indicator Design. Retrieved March 21, 2018. ↩
-
Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022. ↩
-
VerSprite. (2018, January 24). Exploiting VyprVPN for MacOS. Retrieved April 20, 2022. ↩
-
French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019. ↩
-
ise. (2019, February 19). Password Managers: Under the Hood of Secrets Management. Retrieved January 22, 2021. ↩
-
Hastings, M. (2014, July 16). Investigating PowerShell Attacks. Retrieved December 1, 2021. ↩
-
Atkinson, J., Winchester, R. (2017, December 7). A Process is No One: Hunting for Token Manipulation. Retrieved December 21, 2017. ↩
-
Aliz Hammond. (2019, August 15). Hiding Malicious Code with “Module Stomping”: Part 1. Retrieved July 14, 2022. ↩
-
Loh, I. (2018, December 21). Detecting Parent PID Spoofing. Retrieved June 3, 2019. ↩