Monitors changes to WDT timeout values, which could indicate unauthorized modifications designed to disable normal reset mechanisms. For example, WDT timeout value is extended beyond acceptable operational limits, potentially allowing unregulated activity. This could be written in STIX as [x-opencti-watchdog:timeout > 'maximum_operational_limit']
| ID | Name | Description | |
| DE-0003.11 | Watchdog Timer (WDT) for Evasion | By modifying watchdog parameters or who “pets” them, an adversary shapes what evidence survives. Extending or disabling timeouts allows long-running processes to operate without forced resets that would expose abnormal CPU or power usage; conversely, shortening windows or relocating the petting source to a low-level ISR can induce frequent resets that wipe volatile traces, break correlation in logs, and explain anomalies as “spurious reboots.” In both directions, the watchdog becomes a timing tool for hiding activity rather than a guardrail against it. | |