Dynamic Analysis

Also called: Malware Sandbox, Malware Detonation

Definition

Executing or opening a file in a synthetic "sandbox" environment to determine if the file is a malicious program or if the file exploits another program such as a document reader.

D3FEND ID: D3-DA
Tactic: Detect
Certification relevance: CySA+GCIHGCIASecurity+

ATT&CK techniques it counters

22 techniques, 70 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1016System Network Configuration Discovery
.001 Internet Connection Discovery .002 Wi-Fi Discovery
T1027Obfuscated Files or Information
.001 Binary Padding .002 Software Packing .004 Compile After Delivery
T1036Masquerading
.001 Invalid Code Signature .003 Rename Legitimate Utilities
T1037Boot or Logon Initialization Scripts
.001 Logon Script (Windows).002 Login Hook .003 Network Logon Script .004 RC Scripts
T1055Process Injection
.003 Thread Execution Hijacking
T1059Command and Scripting Interpreter
.001 PowerShell .002 AppleScript .003 Windows Command Shell .004 Unix Shell .005 Visual Basic .006 Python .007 JavaScript .008 Network Device CLI .009 Cloud API .010 AutoHotKey & AutoIT .011 Lua .012 Hypervisor CLI .013 Container CLI/API
T1114Email Collection
.001 Local Email Collection
T1137Office Application Startup
.001 Office Template Macros .003 Outlook Forms
T1140Deobfuscate/Decode Files or Information
T1204User Execution
.002 Malicious File
T1218System Binary Proxy Execution
.005 Mshta
T1220XSL Script Processing
T1505Server Software Component
.003 Web Shell
T1534Internal Spearphishing
T1546Event Triggered Execution
.002 Screensaver .005 Trap .006 LC_LOAD_DYLIB Addition .008 Accessibility Features .013 PowerShell Profile .015 Component Object Model Hijacking
T1547Boot or Logon Autostart Execution
.001 Registry Run Keys / Startup Folder .009 Shortcut Modification
T1548Abuse Elevation Control Mechanism
.002 Bypass User Account Control
T1562Impair Defenses
.003 Impair Command History Logging
T1564Hide Artifacts
.007 VBA Stomping
T1565Data Manipulation
.003 Runtime Data Manipulation
T1566Phishing
.001 Spearphishing Attachment .002 Spearphishing Link
T1574Hijack Execution Flow
.007 Path Interception by PATH Environment Variable .008 Path Interception by Search Order Hijacking .009 Path Interception by Unquoted Path

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 22 ATT&CK techniques above.

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

32 more in the full list