MITRE D3FENDdefensive technique

D3-EFA Emulated File Analysis

Official page ↗
Tactic
Detect

Definition

Emulating instructions in a file looking for specific patterns.

Related

Counters · MITRE ATT&CK (57)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T1564.007 VBA Stomping sub-technique
  • T0865 Spearphishing Attachment technique
  • T0871 Execution through API technique
  • T1027.004 Compile After Delivery sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1574.008 Path Interception by Search Order Hijacking sub-technique
  • T1574.009 Path Interception by Unquoted Path sub-technique
  • T1574 Hijack Execution Flow technique
  • T1204.002 Malicious File sub-technique
  • T1565 Data Manipulation technique
  • T1565.003 Runtime Data Manipulation sub-technique
  • T1566 Phishing technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1564 Hide Artifacts technique
  • T1114.001 Local Email Collection sub-technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1036.003 Rename Legitimate Utilities sub-technique
  • T1027.001 Binary Padding sub-technique
  • T1027.002 Software Packing sub-technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1546.002 Screensaver sub-technique
  • T1546.005 Trap sub-technique
  • T1546.006 LC_LOAD_DYLIB Addition sub-technique
  • T1546.008 Accessibility Features sub-technique
  • T1546.013 PowerShell Profile sub-technique
Show all 57 ›

Child of · MITRE D3FEND (1)

  • D3-FA File Analysis defensive technique

References