Matching HPsACrpDS-V

URI: MP-HPsACrpDS-V

Package: DataLifecycle

< prev | next >

Description: Finds a host running a Process with read access (crudr) to a locally stored data copy not controlled by a key vault, which it also processes, plus the data access asset representing the data deserialization, the access contexts for the process on this host, any data fields included in the stored data, and optionally the host manager.

Root Pattern: R-HPrpDS

R-HPrpDS

Finds a host running a Process with read access (crudr) to a locally stored data copy, which it also processes, plus the data access asset representing the data deserialization.

Threat Patterns (3)

DS.C.HPsACrpDS-V.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to read and process the locally stored copy of Data.

DS.C.HPsACrpDS-V.2

Use of Process to access Data on stolen device Host: if an attacker can access Process on stolen device Host, they can use the rights of Process to read a local stored copy of Data.

DS.C.HPsACrpDS-V.4

Attacker exploit at Process accesses its input Data: the attacker is able to exploit a vulnerability in process Process, gaining access to the stored copy of Data used by the process on its host device Host.