MITRE D3FEND (Defensive Techniques)
D3-SSC

Shadow Stack Comparisons

Description

Comparing a call stack in system memory with a shadow call stack maintained by the processor to determine unauthorized shellcode activity.

Mapped SPARTA techniques

4 techniques

  • EX-0009Exploit Code FlawsST0004
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Shadow Stack Comparisons counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009 as addressing that same adversary behaviour in the space domain. Shadow-stack comparison is a processor and toolchain feature, so it applies to flight software on hardware that supports it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • EX-0009.01Flight SoftwareST0004
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Shadow Stack Comparisons counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.01 as addressing that same adversary behaviour in the space domain. Shadow-stack comparison is a processor and toolchain feature, so it applies to flight software on hardware that supports it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • EX-0009.02Operating SystemST0004
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Shadow Stack Comparisons counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.02 as addressing that same adversary behaviour in the space domain. Shadow-stack comparison is a processor and toolchain feature, so it applies to flight software on hardware that supports it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • Derived by composition, not from a source that names this pair. D3FEND publishes that Shadow Stack Comparisons counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.03 as addressing that same adversary behaviour in the space domain. Shadow-stack comparison is a processor and toolchain feature, so it applies to flight software on hardware that supports it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Cross-framework references

Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.

Cite as SafeMode Space, d3fend D3-SSC.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.