D3-PHDM
Process Spawn Analysis
Monitor process creation events to detect suspicious process trees, parent-child relationships, and known malicious behaviors.
D3FEND / Detect
Implementation
- Enable process creation logging
- Monitor for suspicious parent-child relationships
- Track command-line arguments
- Alert on known attack patterns
- Baseline normal process behavior
Tools
- Sysmon
- CrowdStrike Falcon
- Carbon Black
- Microsoft Defender for Endpoint
- Elastic Security
ATT&CK mappings
4