type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0018
external_id: DC0018
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Host Status
description: Logging, messaging, and other artifacts that highlight the health and operational state of host-based security sensors, such as Endpoint Detection and Response (EDR) agents, antivirus software, logging services, and system monitoring tools. Monitoring sensor health is essential for detecting misconfigurations, sensor failures, tampering, or deliberate security control evasion by adversaries.

*Data Collection Measures:*

- Windows Event Logs:
 - Event ID 1074 (System Shutdown): Detects unexpected system reboots/shutdowns.
 - Event ID 6006 (Event Log Stopped): Logs when Windows event logging is stopped.
 - Event ID 16 (Sysmon): Detects configuration state changes that may indicate log tampering.
 - Event ID 12 (Windows Defender Status Change) – Detects changes in Windows Defender state.
- Linux/macOS Monitoring:
 - `/var/log/syslog`, `/var/log/auth.log`, `/var/log/kern.log`
 - Journald (journalctl) for kernel and system alerts.
- Endpoint Detection and Response (EDR) Tools:
 - Monitor agent health status, detect sensor tampering, and alert on missing telemetry.
- Mobile Threat Intelligence Logs:
 - Samsung Knox, SafetyNet, iOS Secure Enclave provide sensor health status for mobile endpoints.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Sensor Health
channel: None
name: macos:osquery
channel: interface_details 
name: Windows:perfmon
channel: Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe)
name: macos:unifiedlog
channel: Web service process (e.g., httpd) entering crash loop or consuming excessive CPU
name: AWS:CloudWatch
channel: Sustained spike in CPU usage on EC2 instance with web service role
name: WinEventLog:System
channel: System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations
name: linux:syslog
channel: Out of memory killer invoked or kernel panic entries
name: macos:unifiedlog
channel: Spike in CPU or memory use from non-user-initiated processes
name: AWS:CloudWatch
channel: StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)
name: kubernetes:events
channel: CrashLoopBackOff, OOMKilled, container restart count exceeds threshold
name: WinEventLog:Sysmon
channel: EventCode=16
name: Windows:perfmon
channel: High sustained CPU usage by a single process
name: linux:procfs
channel: Sustained high /proc/[pid]/stat usage
name: AWS:CloudWatch
channel: Sustained EC2 CPU usage above normal baseline
name: prometheus:metrics
channel: Container CPU/Memory usage exceeding threshold
name: linux:syslog
channel: Service stop or disable messages for security tools not reflected in SIEM alerts
name: macos:unifiedlog
channel: Termination or disabling of XProtect, Gatekeeper, or third-party AV daemons
name: AWS:CloudWatch
channel: NetworkOut spike beyond baseline
name: WinEventLog:Microsoft-Windows-TCPIP
channel: Connection queue overflow or failure to allocate TCP state object
name: NSM:Flow
channel: TCP: possible SYN flood or backlog limit exceeded
name: macos:unifiedlog
channel: network stack resource exhaustion, tcp_accept queue overflow, repeated resets
name: WinEventLog:Security
channel: EventCode=1166, 7045
name: auditd:SYSCALL
channel: firmware_update, kexec_load
name: journald:boot
channel: Secure Boot failure, firmware version change
name: macos:unifiedlog
channel: EFI firmware integrity check failed
name: macos:syslog
channel: Hardware UUID or device list drift
name: Windows:perfmon
channel: Sudden spike in outbound throughput without corresponding inbound traffic
name: sar:network
channel: Outbound network saturation with minimal process activity
name: AWS:CloudWatch
channel: Sudden spike in network output without a corresponding inbound request ratio
name: Windows:perfmon
channel: Sudden spikes in CPU/Memory usage linked to specific application processes
name: AWS:CloudMetrics
channel: Autoscaling, memory/cpu alarms, or instance unhealthiness
name: macos:unifiedlog
channel: System Integrity Protection (SIP) state reported as disabled
name: AWS:CloudWatch
channel: Unusual CPU burst or metric anomalies
name: WinEventLog:Security
channel: EventCode=1074
name: WinEventLog:Security
channel: EventCode=6006
name: linux:syslog
channel: system is powering down
name: macos:unifiedlog
channel: System shutdown or reboot requested
name: esxi:hostd
channel: Powering off or restarting host
name: networkdevice:syslog
channel: System reboot scheduled or performed