D3-SFA

Detect
System File Analysis

Definition

Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.

How it works

This technique ensures the integrity of system owned file resources. System files can impact the behavior below the user level.

Considerations

•Need to manage the size of log file analysis.

•False positives are a concern with this technique and filtering will need to be given additional thought.

•A baseline or snapshot of file checksums should be established for future comparison.

Artifact Relationships

This defensive technique relates to specific digital artifacts.

analyzes
verifies
System File Analysis
Operating System File
Service Application

References

Reference - CAR-2019-07-001: Access Permission Modification - MITRE Reference - CAR-2013-01-002: Autorun Differences - MITRE Reference - CAR-2016-04-002: User Activity from Clearing Event Logs - MITRE