D3-SFA

System File Analysis

Monitor changes to system files and directories to detect unauthorized modifications and persistence mechanisms.

D3FEND / Detect

Implementation

  • Deploy file integrity monitoring
  • Baseline critical system files
  • Alert on unauthorized changes
  • Monitor registry modifications
  • Track startup item changes

Tools

  • OSSEC
  • Tripwire
  • Wazuh
  • Microsoft Defender
  • Sysmon

ATT&CK mappings

3

MITRE D3FEND ↗