Definition

Analyzing the properties of file create system call invocations.

Artifact Relationships

This defensive technique relates to specific digital artifacts.

References

Reference - CAR-2020-09-001: Scheduled Task - FileAccess - MITRE Reference - CAR-2019-07-002: Lsass Process Dump via Procdump - MITRE