D3-KBPI

Isolate

Kernel-based Process Isolation

Definition

Using kernel-level capabilities to isolate processes.

This defensive technique relates to specific digital artifacts.

Reference - Overview of the seccomp sandbox

T1003 OS Credential Dumping

T1033 System Owner/User Discovery

T1053 Scheduled Task/Job

T1212 Exploitation for Credential Access

T1505 Server Software Component

T1546 Event Triggered Execution

T1550 Use Alternate Authentication Material

T1556 Modify Authentication Process

T1562 Impair Defenses

T1621 Multi-Factor Authentication Request Generation