System File Analysis

Parent: D3-PM

Description

Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.

Mapped SPARTA techniques

No techniques mapped to this control.

Cross-framework references

Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.

Counters 9 in MITRE ATT&CK Enterprise

T1003.007 Proc Filesystem
T1018 Remote System Discovery
T1036.003 Rename Legitimate Utilities
T1055.009 Proc Memory
T1070.002 Clear Linux or Mac System Logs
T1543.002 Systemd Service
T1548.003 Sudo and Sudo Caching
T1556.003 Pluggable Authentication Modules
T1574.006 Dynamic Linker Hijacking

Cite as SafeMode Space, d3fend D3-SFA.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

# Description

›Mapped SPARTA techniques

›Cross-framework references

Counters 9 in MITRE ATT&CK Enterprise

Description

Mapped SPARTA techniques

Cross-framework references