MITRE D3FENDdefensive technique

D3-FA File Analysis

Official page ↗
Tactic
Detect

Definition

File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.

How it works

Technique Overview Some techniques use file signatures or file metadata to compare against historical collections of malware. Files may also be compared against a source of ground truth such as cryptographic signatures. Examining files for potential malware using pattern matching against file contents/file behavior. Binary code may be dissembled and analyzed for predictive malware behavior, such as API call signatures. Analysis might occur within a protected environment such as a sandbox or live system.

Related

Counters · MITRE ATT&CK (127)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T0893 Data from Local System technique
  • T1649 Steal or Forge Authentication Certificates technique
  • T0888 Remote System Information Discovery technique
  • T1564.007 VBA Stomping sub-technique
  • T1564.006 Run Virtual Instance sub-technique
  • T1556.003 Pluggable Authentication Modules sub-technique
  • T1574.012 COR_PROFILER sub-technique
  • T0851 Rootkit technique
  • T0865 Spearphishing Attachment technique
  • T0871 Execution through API technique
  • T1127.001 MSBuild sub-technique
  • T1027.004 Compile After Delivery sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1573 Encrypted Channel technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1574.004 Dylib Hijacking sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1564.002 Hidden Users sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1574.001 DLL sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1574.008 Path Interception by Search Order Hijacking sub-technique
  • T1574.009 Path Interception by Unquoted Path sub-technique
  • T1574 Hijack Execution Flow technique
  • T1204.002 Malicious File sub-technique
Show all 127 ›

Referenced by MITRE D3FEND · child of (4)

  • D3-DA Dynamic Analysis defensive technique
  • D3-EFA Emulated File Analysis defensive technique
  • D3-FCOA File Content Analysis defensive technique
  • D3-FH File Hashing defensive technique