D3-RS

Restore

Restore Software

Definition

Restoring software to a host.

This defensive technique relates to specific digital artifacts.

Reference - Cybersecurity Incident and Vulnerability Response Playbooks

T1014 Rootkit

T1056 Input Capture

T1072 Software Deployment Tools

T1127 Trusted Developer Utilities Proxy Execution

T1137 Office Application Startup

T1176 Software Extensions

T1195 Supply Chain Compromise

T1212 Exploitation for Credential Access

T1218 System Binary Proxy Execution

T1490 Inhibit System Recovery

T1497 Virtualization/Sandbox Evasion

T1505 Server Software Component

T1542 Pre-OS Boot

T1546 Event Triggered Execution

T1547 Boot or Logon Autostart Execution

T1554 Compromise Host Software Binary

T1564 Hide Artifacts

T1574 Hijack Execution Flow

T1649 Steal or Forge Authentication Certificates