D3-OSM

Detect
Operating System Monitoring

Definition

The operating system software, for D3FEND's purposes, includes the kernel and its process management functions, hardware drivers, initialization or boot logic. It also includes and other key system daemons and their configuration. The monitoring or analysis of these components for unauthorized activity constitute **Operating System Monitoring**.

Technique Overview

"An operating system (OS) is system software that manages computer hardware and software resources and provides common services for computer programs." [1]

Operating System Monitoring Techniques have varied implementations including built-in kernel modules, third-party privileged system daemons, or even standard systems administration tools included with an operating system.

1. http://dbpedia.org/resource/Operating_system

Artifact Relationships

This defensive technique relates to specific digital artifacts.

monitors
analyzes
analyzes
monitors
analyzes
analyzes
analyzes
verifies
analyzes
Operating System Monitoring
Network Node
Process Code Segment
Input Device
Operating System Process
User Init Configuration File
Operating System File
System Init Configuration
Service Application
Job Schedule

References

Reference - Host intrusion prevention system using software and user behavior analysis - Sophos Ltd Reference - CAR-2016-04-002: User Activity from Clearing Event Logs - MITRE