D3-PT

Process Termination

Kill malicious processes to stop active threats and prevent further damage.

D3FEND / Evict

Implementation

  • Establish process kill procedures
  • Use EDR for remote termination
  • Document process hierarchies
  • Prevent process resurrection
  • Coordinate with forensic collection

Tools

  • CrowdStrike Falcon
  • Microsoft Defender for Endpoint
  • Carbon Black
  • Tanium
  • SentinelOne

ATT&CK mappings

3

MITRE D3FEND ↗