ARTIFACTS

D3FEND

Top Level Artifacts

Digital Artifact

Address Space

Memory Extent

Shadow Stack

Thread

Memory Address

Page Table

Software Package

User

User Account

User Action

User Behavior

User Interface

User to User Message

Volume

Dependency

Link

Binary Large Object

Binary Segment

Blob

Block Device

Boot Loader

Call Stack

Certificate

Clipboard

Command

Credential

Cryptographic Key

Database

Decoy Artifact

Digital System

Directory

Display Server

DNS Lookup

Domain Registration

Enclave

File Selection

File System

File System Link

Hardware Device

Hardware Driver

Identifier

Interprocess Communication

Intrusion Detection System

Kernel Process Table

Log

Metadata

Network

Network Flow

Network Node

Network Traffic

Operating System

Partition

Partition Table

Physical Location

Platform

Pointer

Process

Process Image

Process Tree

Record

Resource

Sensor

Session

Software

Stack Component

Storage

System Call

Task Schedule

Trust Store

Files

File

Archive File

Java Archive

Custom Archive File

Certificate File

CA Certificate File

Configuration File

Operating System Configuration File

Property List File

User Init Configuration File

Application Configuration File

Compiler Configuration File

Container Image

Document File

HTML File

Office Application File

Email Attachment

Multimedia Document File

Executable File

Executable Binary

Executable Script

Init Script

Network Init Script File Resource

User Init Script

PowerShell Profile Script

Python Script File

System Init Script

User Startup Script File

Web Script File

Password File

Symbolic Link

Fast Symbolic Link

NTFS Junction Point

NTFS Symbolic Link

POSIX Symbolic Link

Slow Symbolic Link

Alias

NTFS Link

NTFS Hard Link

Software Library File

Log File

Operating System Log File

Command History Log File

Object File

Kernel Module

Shared Library File

Operating System Shared Library File

Operating System File

Operating System Executable File

Shortcut File

Windows Shortcut File

Database File

Network Traffic

Network Packets

Network Session

Remote Command

Remote Procedure Call

Remote Database Query

Remote Terminal Session

Outbound Network Traffic

Outbound Internet DNS Lookup Traffic

Outbound Internet File Transfer Traffic

Outbound Internet Network Traffic

Outbound Internet Web Traffic

Outbound Internet Encrypted Web Traffic

Outbound Internet Encrypted Traffic

Outbound Internet Encrypted Remote Terminal Traffic

Outbound Internet Mail Traffic

Outbound Internet RPC Traffic

RPC Network Traffic

Intranet RPC Network Traffic

Web Network Traffic

Intranet Web Network Traffic

IPC Network Traffic

Intranet IPC Network Traffic

Mail Network Traffic

Inbound Internet Mail Traffic

Administrative Network Traffic

Intranet Administrative Network Traffic

DNS Network Traffic

File Transfer Network Traffic

Internet File Transfer Traffic

Intranet File Transfer Traffic

Inbound Network Traffic

Inbound Internet Network Traffic

Inbound Internet DNS Response Traffic

Internet Network Traffic

Intranet Network Traffic

Intranet Multicast Network Traffic

Local Area Network Traffic

Software

Software Library

Shim

Application Shim

Software Patch

Subroutine

Exception Handler

Input Function

User Input Function

Stored Procedure

Authentication Function

Console Output Function

Copy Memory Function

Deserialization Function

Eval Function

External Content Inclusion Function

File Path Open Function

Import Library Function

Log Message Function

Mathematical Function

Memory Allocation Function

Memory Free Function

Pointer Dereferencing Function

Process Start Function

Raw Memory Access Function

Serialization Function

Shared Resource Access Function

String Format Function

Thread Start Function

System Service Software

Local Authorization Service

Task Scheduler Software

Local Authentication Service

System Software

Host-based Firewall

Kernel

Utility Software

System Time Application

Network Agent

Application

Client Application

Password Manager

Service Application

Software Deployment Tool

Virtualization Software

Container Orchestration Software

Container Runtime

Credential Management System

Web Server Application

User Application

Office Application

Browser

Browser Extension

Collaborative Software

Business Communication Platform Client

Chatroom Client

Instant Messaging Client

Developer Application

Build Tool

Compiler

Software Packaging Tool

Container Build Tool

Operating System Packaging Tool

Code Analyzer

Dynamic Analysis Tool

Static Analysis Tool

Source Code Analyzer Tool

Test Execution Tool

Integration Test Execution Tool

Unit Test Execution Tool

Version Control Tool

Network Traffic Analysis Software

Application Installer

Firmware

Microcode

Peripheral Firmware

Graphics Card Firmware

Hard Disk Firmware

Human Input Device Firmware

Network Card Firmware

Peripheral Hub Firmware

System Firmware

File

A file maintained in computer-readable form.

ID: d3f:File

ⓘ

Type: Files

Informational References

https://d3fend.mitre.org/dao/artifact/d3f:File/

D3FEND Techniques

Name	Description
D3-PH	Hardening components of a Platform with the intention of making them more difficult to exploit. Platforms includes components such as: * BIOS UEFI Subsystems * Hardware security devices such as Trusted Platform Modules * Boot process logic or code * Kernel software components
D3-FE	Encrypting a file using a cryptographic key.
D3-LFP	Restricting access to a local file by configuring operating system functionality.
D3-FA	File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.
D3-FCR	Employing a pattern matching rule language to analyze files.
D3-FH	Employing file hash comparisons to detect known malware.
D3-DO	A Decoy Object is created and deployed for the purposes of deceiving attackers.
D3-DF	A file created for the purposes of deceiving an adversary.
D3-FEV	File eviction techniques evict files from system storage.
D3-FR	The file removal technique deletes malicious artifacts or programs from a computer system.

SPARTA Countermeasures

ID	Name	Description
CM0049	Machine Learning Data Integrity	When AI/ML is being used for mission critical operations, the integrity of the training data set is imperative. Data poisoning against the training data set can have detrimental effects on the functionality of the AI/ML. Fixing poisoned models is very difficult so model developers need to focus on countermeasures that could either block attack attempts or detect malicious inputs before the training cycle occurs. Regression testing over time, validity checking on data sets, manual analysis, as well as using statistical analysis to find potential injects can help detect anomalies.
CM0013	Dependency Confusion	Ensure proper protections are in place for ensuring dependency confusion is mitigated like ensuring that internal dependencies be pulled from private repositories vice public repositories, ensuring that your CI/CD/development environment is secure as defined in CM0004 and validate dependency integrity by ensuring checksums match official packages.
CM0017	Coding Standard	Define acceptable coding standards to be used by the software developer. The mission should have automated means to evaluate adherence to coding standards. The coding standard should include the acceptable software development language types as well. The language should consider the security requirements, scalability of the application, the complexity of the application, development budget, development time limit, application security, available resources, etc. The coding standard and language choice must ensure proper security constructs are in place.
CM0039	Least Privilege	Employ the principle of least privilege, allowing only authorized processes which are necessary to accomplish assigned tasks in accordance with system functions. Ideally maintain a separate execution domain for each executing process.
CM0067	Smart Contracts	Smart contracts can be used to mitigate harm when an attacker is attempting to compromise a hosted payload. Smart contracts will stipulate security protocol required across a bus and should it be violated, the violator will be barred from exchanges across the system after consensus achieved across the network.
CM0014	Secure boot	Software/Firmware must verify a trust chain that extends through the hardware root of trust, boot loader, boot configuration file, and operating system image, in that order. The trusted boot/RoT computing module should be implemented on radiation tolerant burn-in (non-programmable) equipment.