System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)

Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Dynamic Linker Hijacking - T1574.006 (633a100c-b2c9-41bf-9be5-905c1b16c825)	Attack Pattern	System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	1
Proc Filesystem - T1003.007 (3120b9fa-23b8-4500-ae73-09494f607b7d)	Attack Pattern	System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	1
Clear Linux or Mac System Logs - T1070.002 (2bce5b30-7014-4a5d-ade7-12913fe6ac36)	Attack Pattern	System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	1
Sudo and Sudo Caching - T1548.003 (1365fe3b-0f50-455d-b4da-266ce31c23b0)	Attack Pattern	System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	1
System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	Proc Memory - T1055.009 (d201d4cc-214d-4a74-a1ba-b3fa09fd4591)	Attack Pattern	1
Rename System Utilities - T1036.003 (bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b)	Attack Pattern	System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	1
Systemd Service - T1543.002 (dfefe2ed-4389-4318-8762-f0272b350a1b)	Attack Pattern	System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	1
Pluggable Authentication Modules - T1556.003 (06c00069-771a-4d57-8ef5-d3718c1a8771)	Attack Pattern	System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	1
System File Analysis (9ad8e124-512b-5c6f-b66b-69c71cc604b5)	MITRE D3FEND	Remote System Discovery - T1018 (e358d692-23c0-4a31-9eb6-ecc13a8d7735)	Attack Pattern	1
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	Dynamic Linker Hijacking - T1574.006 (633a100c-b2c9-41bf-9be5-905c1b16c825)	Attack Pattern	2
Proc Filesystem - T1003.007 (3120b9fa-23b8-4500-ae73-09494f607b7d)	Attack Pattern	OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22)	Attack Pattern	2
Clear Linux or Mac System Logs - T1070.002 (2bce5b30-7014-4a5d-ade7-12913fe6ac36)	Attack Pattern	Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69)	Attack Pattern	2
Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b)	Attack Pattern	Sudo and Sudo Caching - T1548.003 (1365fe3b-0f50-455d-b4da-266ce31c23b0)	Attack Pattern	2
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	Proc Memory - T1055.009 (d201d4cc-214d-4a74-a1ba-b3fa09fd4591)	Attack Pattern	2
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0)	Attack Pattern	Rename System Utilities - T1036.003 (bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b)	Attack Pattern	2
Systemd Service - T1543.002 (dfefe2ed-4389-4318-8762-f0272b350a1b)	Attack Pattern	Create or Modify System Process - T1543 (106c0cf6-bf73-4601-9aa8-0945c2715ec5)	Attack Pattern	2
Pluggable Authentication Modules - T1556.003 (06c00069-771a-4d57-8ef5-d3718c1a8771)	Attack Pattern	Modify Authentication Process - T1556 (f4c1826f-a322-41cd-9557-562100848c84)	Attack Pattern	2