D3-RC

Restore

Restore Configuration

Definition

Restoring an software configuration.

This defensive technique relates to specific digital artifacts.

Reference - Cybersecurity Incident and Vulnerability Response Playbooks

T1037 Boot or Logon Initialization Scripts

T1114 Email Collection

T1134 Access Token Manipulation

T1137 Office Application Startup

T1218 System Binary Proxy Execution

T1222 File and Directory Permissions Modification

T1484 Domain or Tenant Policy Modification

T1490 Inhibit System Recovery

T1518 Software Discovery

T1526 Cloud Service Discovery

T1538 Cloud Service Dashboard

T1546 Event Triggered Execution

T1547 Boot or Logon Autostart Execution

T1548 Abuse Elevation Control Mechanism

T1552 Unsecured Credentials

T1553 Subvert Trust Controls

T1556 Modify Authentication Process

T1562 Impair Defenses

T1564 Hide Artifacts

T1574 Hijack Execution Flow

T1578 Modify Cloud Compute Infrastructure

T1614 System Location Discovery

T1615 Group Policy Discovery

T1666 Modify Cloud Resource Hierarchy