D3FEND 技术详情

D3-FA

File Analysis

定义

File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.

父技术

无

子技术

D3-DADynamic Analysis D3-EFAEmulated File Analysis D3-FCOAFile Content Analysis D3-FHFile Hashing

关联构件

File

A file maintained in computer-readable form.

语义关系

出向analyzesFile

出向enablesDetect

关联 ATT&CK

110

DE-0007Evasion via Rootkit

Detect · File Analysis

Kernel Module modifies File · analyzes

EX-0010.02Wiper Malware

Detect · File Analysis

File modifies File · analyzes

EX-0010.03Rootkit

Detect · File Analysis

Kernel Module modifies File · analyzes

T0851Rootkit

Detect · File Analysis

Shared Library File may-modify File · analyzes

Detect · File Analysis

Kernel Module may-modify File · analyzes

T0853Scripting

Detect · File Analysis

Executable Script executes File · analyzes

T0865Spearphishing Attachment

Detect · File Analysis

Email produces File · analyzes

T0871Execution through API

Detect · File Analysis

Executable Script executes File · analyzes

T0888Remote System Information Discovery

Detect · File Analysis

Operating System Configuration File may-access File · analyzes

T0893Data from Local System

Detect · File Analysis

Configuration File may-access File · analyzes

Detect · File Analysis

Database File may-access File · analyzes

T0894System Binary Proxy Execution

Detect · File Analysis

Executable Script executes File · analyzes

Detect · File Analysis

Shared Library File loads File · analyzes

T0895Autorun Image

Detect · File Analysis

Executable Script executes File · analyzes

T1003.007Proc Filesystem

Detect · File Analysis

Operating System File accesses File · analyzes

T1003.008/etc/passwd and /etc/shadow

Detect · File Analysis

Password File accesses File · analyzes

T1005Data from Local System

Detect · File Analysis

File accesses File · analyzes

T1014Rootkit

Detect · File Analysis

Shared Library File may-modify File · analyzes

Detect · File Analysis

Kernel Module may-modify File · analyzes

T1016System Network Configuration Discovery

Detect · File Analysis

Executable Script may-execute File · analyzes

T1018Remote System Discovery

Detect · File Analysis

Operating System Configuration File may-access File · analyzes

T1027.001Binary Padding

Detect · File Analysis

Executable Binary modifies File · analyzes

T1027.002Software Packing

Detect · File Analysis

Executable File obfuscates File · analyzes

T1027.004Compile After Delivery

Detect · File Analysis

Executable File creates File · analyzes

T1033System Owner/User Discovery

Detect · File Analysis

Password File may-access File · analyzes

T1036.001Invalid Code Signature

Detect · File Analysis

Executable Binary creates File · analyzes

T1036.003Rename Legitimate Utilities

Detect · File Analysis

Operating System Executable File may-modify File · analyzes

Detect · File Analysis

Executable File may-create File · analyzes

T1036.005Match Legitimate Resource Name or Location

Detect · File Analysis

File may-create File · analyzes

T1036.006Space after Filename

Detect · File Analysis

File creates File · analyzes

T1037.001Logon Script (Windows)

Detect · File Analysis

User Init Script modifies File · analyzes

T1037.002Login Hook

Detect · File Analysis

User Init Script modifies File · analyzes

T1037.003Network Logon Script

Detect · File Analysis

Network Init Script File Resource modifies File · analyzes

T1037.004RC Scripts

Detect · File Analysis

System Init Script modifies File · analyzes

T1041Exfiltration Over C2 Channel

Detect · File Analysis

Certificate File may-transfer File · analyzes

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Detect · File Analysis

Certificate File may-transfer File · analyzes

T1053.004Launchd

Detect · File Analysis

Property List File creates File · analyzes

T1055.001Dynamic-link Library Injection

Detect · File Analysis

Shared Library File adds File · analyzes

Detect · File Analysis

Shared Library File loads File · analyzes

T1055.002Portable Executable Injection

Detect · File Analysis

Object File may-add File · analyzes

T1055.003Thread Execution Hijacking

Detect · File Analysis

Executable Binary may-add File · analyzes

T1055.009Proc Memory

Detect · File Analysis

Operating System File accesses File · analyzes

Detect · File Analysis

Operating System File may-modify File · analyzes

T1055.014VDSO Hijacking

Detect · File Analysis

Shared Library File accesses File · analyzes

T1059Command and Scripting Interpreter

Detect · File Analysis

Executable Script executes File · analyzes

T1070.002Clear Linux or Mac System Logs

Detect · File Analysis

Operating System Log File modifies File · analyzes

T1070.004File Deletion

Detect · File Analysis

File may-modify File · analyzes

Detect · File Analysis

File deletes File · analyzes

T1071Application Layer Protocol

Detect · File Analysis

Certificate File may-transfer File · analyzes

T1071.001Web Protocols

Detect · File Analysis

Certificate File may-transfer File · analyzes

T1072Software Deployment Tools

Detect · File Analysis

File adds File · analyzes

T1074.001Local Data Staging

Detect · File Analysis

File may-create File · analyzes

T1083File and Directory Discovery

Detect · File Analysis

File accesses File · analyzes

T1114.001Local Email Collection

Detect · File Analysis

Email reads File · analyzes

T1119Automated Collection

Detect · File Analysis

File accesses File · analyzes

T1127.001MSBuild

Detect · File Analysis

Compiler Configuration File modifies File · analyzes

T1137.001Office Template Macros

Detect · File Analysis

Executable Script may-add File · analyzes

Detect · File Analysis

Executable Script may-modify File · analyzes

T1137.003Outlook Forms

Detect · File Analysis

Office Application File adds File · analyzes

T1140Deobfuscate/Decode Files or Information

Detect · File Analysis

Executable File may-add File · analyzes

T1187Forced Authentication

Detect · File Analysis

Windows Shortcut File may-modify File · analyzes

T1204.002Malicious File

Detect · File Analysis

Executable File executes File · analyzes

T1218.005Mshta

Detect · File Analysis

Microsoft HTML Application interprets File · analyzes

T1218.011Rundll32

Detect · File Analysis

Shared Library File loads File · analyzes

T1220XSL Script Processing

Detect · File Analysis

File adds File · analyzes

Detect · File Analysis

Executable Script interprets File · analyzes

T1486Data Encrypted for Impact

Detect · File Analysis

File encrypts File · analyzes

T1505.003Web Shell

Detect · File Analysis

Web Script File adds File · analyzes

T1534Internal Spearphishing

Detect · File Analysis

Email produces File · analyzes

T1543.001Launch Agent

Detect · File Analysis

Property List File creates File · analyzes

T1543.002Systemd Service

Detect · File Analysis

Operating System Configuration File may-modify File · analyzes

Detect · File Analysis

Operating System Configuration File may-create File · analyzes

T1543.004Launch Daemon

Detect · File Analysis

Property List File modifies File · analyzes

T1546.002Screensaver

Detect · File Analysis

Executable File creates File · analyzes

T1546.004Unix Shell Configuration Modification

Detect · File Analysis

User Init Configuration File modifies File · analyzes

T1546.005Trap

Detect · File Analysis

Executable Script may-create File · analyzes

Detect · File Analysis

Executable Script may-modify File · analyzes

T1546.006LC_LOAD_DYLIB Addition

Detect · File Analysis

Executable Binary modifies File · analyzes

T1546.008Accessibility Features

Detect · File Analysis

Executable Binary may-modify File · analyzes

T1546.009AppCert DLLs

Detect · File Analysis

Shared Library File loads File · analyzes

T1546.010AppInit DLLs

Detect · File Analysis

Shared Library File loads File · analyzes

T1546.013PowerShell Profile

Detect · File Analysis

PowerShell Profile Script modifies File · analyzes

T1546.014Emond

Detect · File Analysis

Property List File may-create File · analyzes

Detect · File Analysis

Property List File may-modify File · analyzes

T1546.015Component Object Model Hijacking

Detect · File Analysis

Executable Binary loads File · analyzes

T1547.001Registry Run Keys / Startup Folder

Detect · File Analysis

User Startup Script File may-modify File · analyzes

T1547.006Kernel Modules and Extensions

Detect · File Analysis

Kernel Module modifies File · analyzes

T1547.007Re-opened Applications

Detect · File Analysis

Application Configuration File modifies File · analyzes

T1547.008LSASS Driver

Detect · File Analysis

Shared Library File may-create File · analyzes

T1547.009Shortcut Modification

Detect · File Analysis

User Startup Script File may-modify File · analyzes

Detect · File Analysis

Symbolic Link may-modify File · analyzes

T1547.011Plist Modification

Detect · File Analysis

Application Configuration File modifies File · analyzes

T1548.002Bypass User Account Control

Detect · File Analysis

Executable File executes File · analyzes

T1548.003Sudo and Sudo Caching

Detect · File Analysis

Operating System Configuration File modifies File · analyzes

T1552.001Credentials In Files

Detect · File Analysis

File accesses File · analyzes

T1552.003Shell History

Detect · File Analysis

Command History Log File accesses File · analyzes

T1555Credentials from Password Stores

Detect · File Analysis

Database File may-access File · analyzes

T1555.003Credentials from Web Browsers

Detect · File Analysis

Database File accesses File · analyzes

T1556.002Password Filter DLL

Detect · File Analysis

Shared Library File creates File · analyzes

T1556.003Pluggable Authentication Modules

Detect · File Analysis

Operating System Shared Library File may-modify File · analyzes

Detect · File Analysis

Operating System Configuration File may-modify File · analyzes

T1560Archive Collected Data

Detect · File Analysis

Archive File creates File · analyzes

T1560.001Archive via Utility

Detect · File Analysis

Archive File creates File · analyzes

T1560.002Archive via Library

Detect · File Analysis

Archive File creates File · analyzes

T1560.003Archive via Custom Method

Detect · File Analysis

Custom Archive File creates File · analyzes

T1562.003Impair Command History Logging

Detect · File Analysis

User Init Script may-modify File · analyzes

T1564.002Hidden Users

Detect · File Analysis

User Init Configuration File modifies File · analyzes

T1564.003Hidden Window

Detect · File Analysis

Property List File may-modify File · analyzes

T1564.006Run Virtual Instance

Detect · File Analysis

File creates File · analyzes

T1564.007VBA Stomping

Detect · File Analysis

Office Application File modifies File · analyzes

T1565.001Stored Data Manipulation

Detect · File Analysis

File modifies File · analyzes

T1565.003Runtime Data Manipulation

Detect · File Analysis

Executable File may-modify File · analyzes

T1566.001Spearphishing Attachment

Detect · File Analysis

Email produces File · analyzes

T1566.002Spearphishing Link

Detect · File Analysis

Email produces File · analyzes

T1566.003Spearphishing via Service

Detect · File Analysis

File produces File · analyzes

T1573.002Asymmetric Cryptography

Detect · File Analysis

Certificate File may-transfer File · analyzes

T1574.001DLL

Detect · File Analysis

Shared Library File may-create File · analyzes

T1574.002DLL Side-Loading

Detect · File Analysis

Shared Library File may-create File · analyzes

Detect · File Analysis

Shared Library File may-modify File · analyzes

T1574.004Dylib Hijacking

Detect · File Analysis

Shared Library File may-create File · analyzes

Detect · File Analysis

Shared Library File may-modify File · analyzes

T1574.006Dynamic Linker Hijacking

Detect · File Analysis

Operating System Configuration File modifies File · analyzes

T1574.007Path Interception by PATH Environment Variable

Detect · File Analysis

Executable File creates File · analyzes

T1574.008Path Interception by Search Order Hijacking

Detect · File Analysis

Executable File creates File · analyzes

T1574.009Path Interception by Unquoted Path

Detect · File Analysis

Executable File creates File · analyzes

T1574.012COR_PROFILER

Detect · File Analysis

Shared Library File adds File · analyzes

T1649Steal or Forge Authentication Certificates

Detect · File Analysis

Certificate File accesses File · analyzes

查看关系图在矩阵中定位