NIST-SC-44 Detonation Chambers

Employ a detonation chamber capability within [Assignment: system, system component, or location].

Detonation chambers, also known as dynamic execution environments, allow organizations to open email attachments, execute untrusted or suspicious applications, and execute Universal Resource Locator requests in the safety of an isolated environment or a virtualized sandbox. Protected and isolated execution environments provide a means of determining whether the associated attachments or applications contain malicious code. While related to the concept of deception nets, the employment of detonation chambers is not intended to maintain a long-term environment in which adversaries can operate and their actions can be observed. Rather, detonation chambers are intended to quickly identify malicious code and either reduce the likelihood that the code is propagated to user environments of operation or prevent such propagation completely.

• T1137 Office Application Startup • T1137.001 Office Template Macros • T1137.002 Office Test • T1137.003 Outlook Forms • T1137.004 Outlook Home Page • T1137.005 Outlook Rules • T1137.006 Add-ins • T1203 Exploitation for Client Execution • T1204 User Execution • T1204.001 Malicious Link • T1204.002 Malicious File • T1204.003 Malicious Image • T1221 Template Injection • T1564.009 Resource Forking • T1566 Phishing • T1566.001 Spearphishing Attachment • T1566.002 Spearphishing Link • T1566.003 Spearphishing via Service • T1598 Phishing for Information • T1598.001 Spearphishing Service • T1598.002 Spearphishing Attachment • T1598.003 Spearphishing Link