Esc
Process Eviction
Definition
Process eviction techniques terminate or remove running process.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 6 techniques in this category, Process Eviction.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Process Eviction | D3-PE | Process eviction techniques terminate or remove running process. | |
| - Process Termination | D3-PT | Terminating a running application process on a computer system. | |
| - Session Termination | D3-ST | Forcefully end all active sessions associated with compromised accounts or devices. | |
| - Process Suspension | D3-PS | Suspending a running process on a computer system. | |
| - Host Reboot | D3-HR | Initiating a host's reboot sequence to terminate all running processes. | |
| - Host Shutdown | D3-HS | Initiating a host's shutdown sequence to terminate all running processes. |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Lateral Movement
Remote Services
Use Alternate Authentication Material
Remote Service Session Hijacking
Privilege Escalation
Event Triggered Execution
Scheduled Task/Job
Access Token Manipulation
Discovery
System Owner/User Discovery
Persistence
External Remote Services
Event Triggered Execution
Server Software Component
Scheduled Task/Job
Modify Authentication Process
Initial Access
External Remote Services
Trusted Relationship
Credential Access
Exploitation for Credential Access
OS Credential Dumping
Multi-Factor Authentication Request Generation
Modify Authentication Process
Defense Evasion
Use Alternate Authentication Material
Impair Defenses
Modify Authentication Process
Access Token Manipulation
References
All
Patent
The following references were used to develop the Process Eviction knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Malware detection using local computational models
Reference Type: Patent Organization: Crowdstrike Inc Author: Sven Krasser,David Elkind, Patrick Crenshaw, Kirby James Koster