When a malicious process or an attacker's session is found, responders have to choose how to stop it, and the wrong choice either destroys the evidence they need or leaves the attacker running. MITRE D3FEND groups these actions under Process Eviction (D3-PE), a technique in the Evict tactic defined as "Process eviction techniques terminate or remove running process." This guide treats D3-PE as a decision and implementation programme across its children: suspension, termination, session termination, shutdown and reboot. It covers what each one does and does not achieve, how to choose and sequence them during an incident, how to pre-authorise them, how to verify them and where they fail. It does not repeat the child technique cards, which are linked below. It is written for incident responders, SOC leads and endpoint and identity engineers. For the wider containment plan see the Incident Scoping and Containment Strategy Guide.
Key takeaways
- Process Eviction has four direct children and one grandchild. D3FEND lists Process Suspension, Process Termination, Session Termination and Host Shutdown under D3-PE, with Host Reboot under Host Shutdown.
- The options run from precise to blunt. Suspending one process keeps memory for analysis; terminating it ends the activity; ending sessions removes the attacker's interactive access; shutdown and reboot end everything on the host.
- Eviction stops activity, not the intrusion. Persistence, stolen credentials and files on disk survive every child technique, so eviction must be paired with credential revocation and file eviction.
- Order matters. Capture volatile evidence before blunt actions, and revoke credentials before or at the same moment as ending sessions, or the attacker signs straight back in.
- D3FEND's ATT&CK links are inferred. They come from the shared Process and Session artefacts and are labelled "inferred, experimental".
What D3FEND means by Process Eviction
In the D3FEND ontology (knowledge graph 1.6.0, checked November 2026) D3-PE is a defensive technique that enables the Evict tactic. The parent entry is short: a one-line definition and a single reference, a CrowdStrike patent on malware detection using local computational models. It names no digital artefact itself; the artefacts sit on the children, which act on Process or, for Session Termination, delete the Session artefact. Evict sits after Detect and Isolate in D3FEND's tactic order, and its sibling families include Credential Eviction and Object Eviction, whose members such as D3-CR Credential Revocation and D3-FEV File Eviction remove what process eviction leaves behind.
The child techniques at a glance
Definitions are D3FEND's own; the remaining columns summarise the linked cards.
| D3FEND technique | D3FEND definition | Evidence impact | What it leaves behind |
|---|---|---|---|
| D3-PS Process Suspension | Suspending a running process on a computer system | Preserves process memory for capture | A frozen process that can be resumed, by you or by anything with rights to resume it |
| D3-PT Process Termination | Terminating a running application process on a computer system | Destroys that process's memory | Persistence that restarts it, child processes, stolen credentials |
| D3-ST Session Termination | Forcefully end all active sessions associated with compromised accounts or devices | Little on the host; sign-in logs remain | Credentials and tokens that can start a new session |
| D3-HS Host Shutdown | Initiating a host's shutdown sequence to terminate all running processes | Destroys all volatile evidence on the host | Everything on disk; the host is offline for the business |
| D3-HR Host Reboot (child of D3-HS) | Initiating a host's reboot sequence to terminate all running processes | Destroys all volatile evidence on the host | Everything on disk, including persistence that runs again at boot |
How to choose between the children
| Situation | Usually first choice | Why |
|---|---|---|
| Malicious process found, investigation needed, host is important | D3-PS, then memory capture, then D3-PT | Stops activity while keeping memory for analysis |
| Active damage, such as encryption or credential dumping in progress | D3-PT, or network isolation plus D3-PT | Speed matters more than evidence |
| Attacker using a valid account interactively (VPN, RDP, SSH, SaaS) | Credential revocation plus D3-ST | Ends sessions that a process kill on one host would not touch |
| Many malicious processes, rootkit suspected or tools untrusted on the host | Network isolation, memory capture if possible, then D3-HS | The host cannot be trusted to report or obey process-level actions |
| Memory-only implant and the host will be rebuilt anyway | Capture memory, then D3-HR or D3-HS | Clears memory; disk persistence still needs removal or rebuild |
A sequencing pattern for a single host
- Decide whether evidence matters. If the incident may need root cause, legal or regulatory evidence, plan memory capture before any eviction. See the Memory Forensics Guide.
- Contain the network path. Host isolation through the endpoint tool limits what the attacker can do while you act, and keeps the management channel open.
- Suspend, capture, then terminate. Suspend the malicious process tree, capture memory, then terminate. Terminate the whole tree, not only the parent.
- Revoke and end sessions together. Disable or rotate the credentials in use and end their sessions and tokens in the same change window.
- Remove persistence. Scheduled tasks, services, web shells and autostart entries restart evicted processes. Remove them, then check nothing respawns.
- Escalate to shutdown only with a reason. Use D3-HS or D3-HR when process-level actions are not trusted or the host is being rebuilt, and record the decision.
Small and large organisations
- Small organisations: the endpoint product's isolate and kill actions and the identity provider's revoke sessions action cover most needs. Write down who may use them and when.
- Large organisations: pre-authorise the low-risk actions (suspend, terminate a known-bad hash, end sessions for a confirmed compromised account) for the SOC, keep shutdown of production servers with the incident commander, and automate the low-risk actions through SOAR with approval gates.
Pre-authorisation and rollback
Eviction actions are disruptive, so decide authority before an incident. A simple approach is a table of actions by asset tier: who may act alone, who must approve and what must be captured first. Test each action on a pilot group of hosts and accounts so that responders know how long it takes and what users see.
- Suspension: reversible by resuming the process; document who may resume.
- Termination: not reversible for that process, but the application can be restarted; know which business processes a terminated service supports.
- Session termination: users sign in again; for service accounts, expect dependent jobs to fail until new credentials are deployed.
- Shutdown and reboot: business outage; for cloud instances, confirm whether the instance type and storage keep data across stop and start before using it.
ATT&CK techniques D3FEND relates to Process Eviction
The D3FEND page for D3-PE lists offensive techniques related through its children's Process and Session artefacts, all labelled "inferred, experimental" (checked November 2026). The selection below uses ATT&CK v20 IDs; every ID was checked against ATT&CK v20.
| ATT&CK technique | Most relevant child | What eviction achieves and what remains |
|---|---|---|
| T1003.001 LSASS Memory, T1003.002 Security Account Manager, T1003.004 LSA Secrets | D3-PS, D3-PT | Stops dumping in progress; credentials already taken stay valid until rotated |
| T1505.003 Web Shell, T1505.002 Transport Agent | D3-PT | Ends spawned commands; the shell or agent file remains until removed |
| T1053.005 Scheduled Task, T1546.007 Netsh Helper DLL | D3-PT | Ends the running instance; the task or DLL starts it again |
| T1133 External Remote Services, T1021.001 Remote Desktop Protocol, T1021.004 SSH | D3-ST | Ends the attacker's interactive session; lasting only if the credential is also blocked |
| T1563.001 SSH Hijacking, T1563.002 RDP Hijacking | D3-ST | Ends the hijacked session |
| T1134.003 Make and Impersonate Token, T1550 Use Alternate Authentication Material | D3-ST, D3-HR | Destroys sessions and tokens in memory; stolen material held elsewhere stays usable |
| T1199 Trusted Relationship, T1621 Multi-Factor Authentication Request Generation, T1556 Modify Authentication Process | D3-ST | Ends current sessions; the relationship, MFA fatigue route or modified authentication component needs separate remediation |
D3FEND also lists Disable or Modify Tools under an ID that ATT&CK v20 has revoked; the successor is T1685 Disable or Modify Tools, and it matters here because an attacker who has disabled your endpoint agent can block process-level eviction. See the T1003 OS Credential Dumping and EDR Tampering and BYOVD Response Playbook pages.
Where identity fits
Session Termination is an identity action, and much of the eviction work in modern incidents happens at the identity provider and cloud control plane rather than on a host. Non-human identities are the hard case: a compromised service account, API key or workload token often has no interactive session to end, and its tokens may stay valid for their full lifetime. Pair D3-ST with credential rotation for every non-human identity the attacker touched, and check whether the platform can revoke issued tokens or only stop new ones. See the Global Token Revocation Guide and the Identity Incident Response Playbook.
Detection and measurement
Verification is part of eviction. After each action confirm that the process or session is gone, that nothing respawns over the next hours, that the host or account generates no further alerts, and that the eviction itself is logged with who did it and why. Watch for the same hash or command line reappearing on other hosts.
Metrics we suggest at NHI Mgmt Group (example measures, not standards):
- Time to evict: median time from a confirmed malicious process or session to its suspension, termination or end.
- Respawn rate: percentage of evictions followed by the same process or session returning within 24 hours.
- Evidence first: percentage of high-severity host evictions preceded by memory capture.
- Paired revocation: percentage of session terminations performed with credential revocation in the same window.
- Pre-authorised coverage: percentage of eviction actions with a documented authority and tested procedure per asset tier.
Framework mapping
| Framework | Reference | Link to D3-PE |
|---|---|---|
| NIST SP 800-53 Rev. 5 | IR-4 Incident Handling, IR-4(1) Automated Incident Handling Processes | Containment and eradication actions, automated where appropriate |
| NIST SP 800-53 Rev. 5 | AC-12 Session Termination, AC-2(13) Disable Accounts for High-risk Individuals | Session and account actions behind D3-ST |
| NIST CSF 2.0 | RS.MI-01, RS.MI-02 | Incidents are contained; incidents are eradicated |
| ISO/IEC 27001:2022 | Annex A 5.26 Response to information security incidents, 5.28 Collection of evidence | Response actions and the evidence that must be kept |
Common failure patterns
- Killing before capturing. Termination or reboot destroys the memory that would have shown the injected code and stolen credentials.
- Evicting without revoking. Sessions are ended but passwords, keys and tokens are not, so the attacker returns within minutes.
- Ignoring persistence. The process is killed and a scheduled task or service starts it again.
- Reboot as eradication. A reboot clears memory but runs every boot-time persistence mechanism again.
- Tipping off the attacker host by host. Evicting on one host while others are still compromised prompts the attacker to change tools; scope first, then evict in one coordinated action where possible.
Practitioner checklist
- Document which eviction actions the SOC may take alone, by asset tier.
- Make memory capture the default before evicting on high-value hosts.
- Suspend, capture, then terminate whole process trees.
- Revoke credentials and end sessions in the same change window, including non-human identities.
- Remove persistence and watch for respawn for at least a day.
- Reserve shutdown and reboot for untrusted hosts or rebuilds, and record why.
- Test each action on pilot hosts and accounts and time it.
- Log every eviction with actor, reason and result.
Standards and references
- MITRE D3FEND: Process Eviction
- MITRE D3FEND: Process Suspension
- MITRE D3FEND: Process Termination
- MITRE D3FEND: Session Termination
- MITRE D3FEND: Host Shutdown
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: LSASS Memory
Related NHI Mgmt Group resources: MITRE D3FEND Guide · Incident Response Guide · Incident Scoping and Containment Strategy Guide · Memory Forensics Guide · D3-CR Credential Revocation