D3-EFA

Detect

Emulated File Analysis

Definition

Emulating instructions in a file looking for specific patterns.

This defensive technique relates to specific digital artifacts.

Reference - Network-level polymorphic shellcode detection using emulation

T1016 System Network Configuration Discovery

T1027 Obfuscated Files or Information

T1036 Masquerading

T1037 Boot or Logon Initialization Scripts

T1055 Process Injection

T1059 Command and Scripting Interpreter

T1114 Email Collection

T1137 Office Application Startup

T1140 Deobfuscate/Decode Files or Information

T1204 User Execution

T1218 System Binary Proxy Execution

T1220 XSL Script Processing

T1505 Server Software Component

T1534 Internal Spearphishing

T1546 Event Triggered Execution

T1547 Boot or Logon Autostart Execution

T1548 Abuse Elevation Control Mechanism

T1562 Impair Defenses

T1564 Hide Artifacts

T1565 Data Manipulation

T1566 Phishing

T1574 Hijack Execution Flow