type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0035
external_id: DC0035
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Process Access
description: Refers to an event where one process attempts to open another process, typically to inspect or manipulate its memory, access handles, or modify execution flow. Monitoring these access attempts can provide valuable insight into both benign and malicious behaviors, such as debugging, inter-process communication (IPC), or process injection.

*Data Collection Measures:*

- Endpoint Detection and Response (EDR) Tools:
 - EDR solutions that provide telemetry on inter-process access and memory manipulation.
- Sysmon (Windows):
 - Event ID 10: Captures process access attempts, including:
 - Source process (initiator)
 - Target process (victim)
 - Access rights requested
 - Process ID correlation
- Windows Event Logs:
 - Event ID 4656 (Audit Handle to an Object): Logs access attempts to system objects.
 - Event ID 4690 (Attempted Process Modification): Can help identify unauthorized process changes.
- Linux/macOS Monitoring:
 - AuditD: Monitors process access through syscall tracing (e.g., `ptrace`, `open`, `read`, `write`).
 - eBPF/XDP: Used for low-level monitoring of kernel process access.
 - OSQuery: Query process access behavior via structured SQL-like logging.
- Procmon (Process Monitor) and Debugging Tools:
 - Windows Procmon: Captures real-time process interactions.
 - Linux strace / ptrace: Useful for tracking process behavior at the system call level.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Sysmon
channel: EventCode=10
name: linux:osquery
channel: Process State
name: auditd:SYSCALL
channel: ptrace attach
name: macos:unifiedlog
channel: ptrace or task_for_pid
name: macos:osquery
channel: process_open
name: auditd:SYSCALL
channel: High frequency of accept(), read(), or SSL_read() syscalls tied to nginx/apache processes
name: Apple TCC Logs
channel: Microphone Access Events
name: auditd:SYSCALL
channel: ptrace
name: linux:syslog
channel: syscalls (open, read, ioctl) on /dev/input or /proc/*/fd/*
name: WinEventLog:Sysmon
channel: EventCode=25
name: macos:endpointsecurity
channel: ES_EVENT_TYPE_NOTIFY_OPEN
name: macos:unifiedlog
channel: Unexpected NSXPCConnection calls by non-Apple-signed or abnormal binaries
name: WinEventLog:Security
channel: EventCode=4663, 4670, 4656
name: macos:unifiedlog
channel: Unusual Mach port registration or access attempts between unrelated processes
name: macos:unifiedlog
channel: subsystem=com.apple.security, library=libsystem_kernel.dylib
name: auditd:SYSCALL
channel: ptrace syscall or access to /proc/*/mem
name: macos:unifiedlog
channel: vm_read, task_for_pid, or file open to cookie databases
name: linux:osquery
channel: process_events
name: auditd:SYSCALL
channel: ACCESS
name: auditd:SYSCALL
channel: execve, fork, mmap, ptrace
name: auditd:SYSCALL
channel: ptrace or process_vm_readv
name: macos:osquery
channel: unexpected memory inspection