type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0034
external_id: DC0034
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Process Metadata
description: Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
mobile-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Process
channel: None
name: macos:unifiedlog
channel: subsystem=com.apple.process
name: WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
channel: CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads
name: linux:syslog
channel: sudo or service accounts invoking loaders with suspicious env vars
name: macos:osquery
channel: Process Context
name: esxi:auth
channel: user session
name: networkdevice:syslog
channel: Admin activity
name: auditd:SYSCALL
channel: execve call for sudo where euid != uid
name: macos:unifiedlog
channel: subsystem=com.apple.TCC
name: macos:unifiedlog
channel: exec of binary with setuid/setgid and EUID != UID
name: macos:unifiedlog
channel: process
name: auditd:SYSCALL
channel: Use of fork/exec with DISPLAY unset or redirected
name: EDR:Telemetry
channel: Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)
name: esxi:hostd
channel: /var/log/hostd.log API calls reading/altering time/ntp settings
name: auditd:SYSCALL
channel: execve, prctl, or ptrace activity affecting process memory or command-line arguments
name: linux:osquery
channel: Cross-reference argv[0] with actual executable path and parent process metadata
name: WinEventLog:AppLocker
channel: AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy
name: EDR:hunting
channel: Correlation of signer info, parent-child lineage, rare invocation context (user host role), and API surfaces (CreateProcess*, LoadLibrary*)
name: WinEventLog:Microsoft-Windows-Security-Mitigations/KernelMode
channel: ETW telemetry indicating ClickOnce deployment (dfsvc.exe) launching payloads
name: etw:Microsoft-Windows-ClickOnce
channel: provider: Event Tracing for Windows (ETW) events associated with ClickOnce deployment (dfsvc.exe activity)
name: WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational
channel: Process session start/stop events for camera pipeline by unexpected executables
name: linux:osquery
channel: select: path LIKE '/dev/video%'
name: linux:osquery
channel: state=attached/debugged
name: macos:unifiedlog
channel: Code Execution & Entitlement Access
name: macos:unifiedlog
channel: Process opening SSH_AUTH_SOCK or /tmp/ssh-* socket not owned by same UID
name: macos:unifiedlog
channel: code signature/memory protection
name: auditd:SYSCALL
channel: execve with UID ≠ EUID
name: auditd:SYSCALL
channel: execve with escalated privileges
name: AWS:CloudTrail
channel: cross-account or unexpected assume role
name: macos:unifiedlog
channel: log collect from launchd and process start
name: containerd:events
channel: Docker or containerd image pulls and process executions
name: linux:syslog
channel: Kernel or daemon warnings of downgraded TLS or cryptographic settings
name: macos:unifiedlog
channel: Modifications or writes to EFI system partition for downgraded bootloaders
name: macos:unifiedlog
channel: non-shell process tree accessing bash history
name: linux:osquery
channel: process metadata mismatch between /proc and runtime attributes
name: linux:osquery
channel: process environment variables containing LD_PRELOAD
name: WinEventLog:PowerShell
channel: EventCode=400, 403
name: macos:osquery
channel: Process Execution + Hash
name: etw:Microsoft-Windows-Kernel-Process
channel: process_start: EventHeader.ProcessId true parent vs reported PPID mismatch
name: macos:endpointsecurity
channel: ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP
name: WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
channel: Unsigned/invalid signature modules or images loaded by msbuild.exe or its children
name: WinEventLog:Microsoft-Windows-DeviceGuard/Operational
channel: WDAC policy audit/block affecting msbuild.exe spawned payloads
name: WinEventLog:Microsoft-Windows-SmartAppControl/Operational
channel: Smart App Control decisions (audit/block) for msbuild.exe-launched executables
name: WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
channel: Unsigned or untrusted modules loaded during JamPlus.exe runtime