D3-RD

Restore

Restore Database

Definition

Restoring the data in a database.

This defensive technique relates to specific digital artifacts.

Reference - Cybersecurity Incident and Vulnerability Response Playbooks

T1003 OS Credential Dumping

T1012 Query Registry

T1033 System Owner/User Discovery

T1112 Modify Registry

T1137 Office Application Startup

T1207 Rogue Domain Controller

T1213 Data from Information Repositories

T1218 System Binary Proxy Execution

T1543 Create or Modify System Process

T1546 Event Triggered Execution

T1548 Abuse Elevation Control Mechanism

T1552 Unsecured Credentials

T1555 Credentials from Password Stores

T1564 Hide Artifacts

T1614 System Location Discovery