D3-PM

Definition

Monitoring platform components such as operating systems software, hardware devices, or firmware.

Platform monitoring consists of the analysis and monitoring of system level devices and low-level components, including hardware devices, to detect unauthorized modifications or suspicious activity.

Monitored platform components includes system files and embedded devices such as:

•Kernel software modules

•Boot process code and load logic

•Operating system components and device files

•System libraries and dynamically loaded files

•Hardware device drivers

•Embedded firmware devices

Artifact Relationships

This defensive technique relates to specific digital artifacts.