Restore Software
Description
Restoring software to a host.
Mapped SPARTA techniques
5 techniques
Derived by composition, not from a source that names this pair. D3FEND publishes that Restore Software counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records EX-0010 as addressing that same adversary behaviour in the space domain. Reloading software to a host is the flight-software recovery upload as well as a ground reimage. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Derived by composition, not from a source that names this pair. D3FEND publishes that Restore Software counters T1195.002 Compromise Software Supply Chain; SafeMode's curated mapping records IA-0002 as addressing that same adversary behaviour in the space domain. Reloading software to a host is the flight-software recovery upload as well as a ground reimage. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Derived by composition, not from a source that names this pair. D3FEND publishes that Restore Software counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records PER-0001 as addressing that same adversary behaviour in the space domain. Reloading software to a host is the flight-software recovery upload as well as a ground reimage. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Derived by composition, not from a source that names this pair. D3FEND publishes that Restore Software counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records PER-0002 as addressing that same adversary behaviour in the space domain. Reloading software to a host is the flight-software recovery upload as well as a ground reimage. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Derived by composition, not from a source that names this pair. D3FEND publishes that Restore Software counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records PER-0002.02 as addressing that same adversary behaviour in the space domain. Reloading software to a host is the flight-software recovery upload as well as a ground reimage. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Counters 25 in MITRE ATT&CK Enterprise
- T1014Rootkit
- T1056.003Web Portal Capture
- T1072Software Deployment Tools
- T1127.001MSBuild
- T1137.006Add-ins
- T1176Software Extensions
- T1195.001Compromise Software Dependencies and Development Tools
- T1195.002Compromise Software Supply Chain
- T1212Exploitation for Credential Access
- T1218.014MMC
- T1490Inhibit System Recovery
- T1497.003Time Based Checks
- T1505.001SQL Stored Procedures
- T1505.004IIS Components
- T1542.001System Firmware
- T1542.002Component Firmware
- T1542.003Bootkit
- T1542.004ROMMONkit
- T1546.011Application Shimming
- T1547.008LSASS Driver
- T1554Compromise Host Software Binary
- T1564.006Run Virtual Instance
- T1574.005Executable Installer File Permissions Weakness
- T1574.010Services File Permissions Weakness
- T1649Steal or Forge Authentication Certificates
Cite as SafeMode Space, d3fend D3-RS.