Esc
Platform Hardening
Definition
Hardening components of a Platform with the intention of making them more difficult to exploit.
Platforms includes components such as:
- BIOS UEFI Subsystems
- Hardware security devices such as Trusted Platform Modules
- Boot process logic or code
- Kernel software components
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 13 techniques in this category, Platform Hardening.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Platform Hardening | D3-PH | Hardening components of a Platform with the intention of making them more difficult to exploit. Platforms includes components such as: * BIOS UEFI Subsystems * Hardware security devices such as Trusted Platform Modules * Boot process logic or code * Kernel software components | System Hardening , and Endpoint Hardening |
| - Software Update | D3-SU | Replacing old software on a computer system component. | |
| - Hardware-based Write Protection | D3-HBWP | Physical methods of preventing data from being written to computer storage. | |
| - RF Shielding | D3-RFS | Adding physical barriers to a platform to prevent undesired radio interference. | |
| - Physical Enclosure Hardening | D3-PEH | Physical changes to a computer enclosure which reduce the ability for agents or the environment to affect the contained computer system. | |
| - System Configuration Permissions | D3-SCP | Restricting system configuration modifications to a specific user or group of users. | |
| - Radiation Hardening | D3-RH | Radiation hardening is the process of making electronic components and circuits resistant to damage or malfunction caused by high levels of ionizing radiation. | |
| - File Encryption | D3-FE | Encrypting a file using a cryptographic key. | |
| - Disk Encryption | D3-DENCR | Encrypting a hard disk partition to prevent cleartext access to a file system. | |
| - Bootloader Authentication | D3-BA | Cryptographically authenticating the bootloader software before system boot. | Secure Boot |
| - TPM Boot Integrity | D3-TBI | Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). | STRM , and Static Root of Trust Measurement |
| - Electromagnetic Radiation Hardening | D3-EMH | The application of physical and material-level design measures to electronic systems, components, or facilities to reduce their susceptibility to damage or disruption from electromagnetic threats. | EM Hardening |
| - Driver Load Integrity Checking | D3-DLIC | Ensuring the integrity of drivers loaded during initialization of the operating system. |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Lateral Movement
Software Deployment Tools
Internal Spearphishing
Replication Through Removable Media
Privilege Escalation
Abuse Elevation Control Mechanism
Event Triggered Execution
Process Injection
Create or Modify System Process
Boot or Logon Autostart Execution
Hijack Execution Flow
Scheduled Task/Job
Boot or Logon Initialization Scripts
Command And Control
Encrypted Channel
Application Layer Protocol
Communication Through Removable Media
Impact
Data Encrypted for Impact
Data Manipulation
Inhibit System Recovery
Collection
Audio Capture
Automated Collection
Video Capture
Data Staged
Archive Collected Data
Data from Removable Media
Data from Local System
Input Capture
Email Collection
Discovery
System Network Configuration Discovery
System Location Discovery
Remote System Discovery
System Owner/User Discovery
File and Directory Discovery
Query Registry
Cloud Storage Object Discovery
Virtualization/Sandbox Evasion
Persistence
Event Triggered Execution
Create or Modify System Process
Server Software Component
Office Application Startup
Boot or Logon Autostart Execution
Hijack Execution Flow
Modify Authentication Process
Scheduled Task/Job
Pre-OS Boot
Software Extensions
Boot or Logon Initialization Scripts
Compromise Host Software Binary
Modify Registry
Initial Access
Phishing
Supply Chain Compromise
Replication Through Removable Media
Hardware Additions
Execution
Software Deployment Tools
User Execution
Command and Scripting Interpreter
Scheduled Task/Job
Credential Access
Exploitation for Credential Access
Unsecured Credentials
Modify Authentication Process
OS Credential Dumping
Forced Authentication
Credentials from Password Stores
Multi-Factor Authentication Interception
Input Capture
Steal or Forge Authentication Certificates
Defense Evasion
Abuse Elevation Control Mechanism
Indicator Removal
Masquerading
Process Injection
System Binary Proxy Execution
Obfuscated Files or Information
Hide Artifacts
Trusted Developer Utilities Proxy Execution
Hijack Execution Flow
Deobfuscate/Decode Files or Information
Modify Authentication Process
Rogue Domain Controller
Rootkit
Pre-OS Boot
Impair Defenses
XSL Script Processing
Modify Registry
Virtualization/Sandbox Evasion
Exfiltration
Exfiltration Over C2 Channel
Exfiltration Over Physical Medium
Exfiltration Over Alternative Protocol