Matching HPsACrDSCCV

URI: MP-HPsACrDSCCV

Package: ProcessComms

< prev | next >

Description: Finds a host running a Process with read access (crudr) to a locally stored data copy, plus the data access asset representing the data deserialization, and a channel to a key vault that controls the stored data, plus any data fields included in the data copy and used by the process, the process access contexts (a non-unique sufficient match), and optionally the process host manager.

Root Pattern: R-HPrDSCCV

R-HPrDSCCV

Finds a host running a Process with read access (crudr) to a locally stored data copy, plus the data access asset representing the data deserialization, and a channel to a key vault that controls the stored data.

Threat Patterns (1)

DS.C.HPsACrDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to read the locally stored copy of Data.