Esc
Emulated File Analysis
Definition
Emulating instructions in a file looking for specific patterns.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , and .
Lateral Movement
Internal Spearphishing
Privilege Escalation
Abuse Elevation Control Mechanism
Event Triggered Execution
Process Injection
Hijack Execution Flow
Boot or Logon Autostart Execution
Boot or Logon Initialization Scripts
Discovery
System Network Configuration Discovery
Persistence
Office Application Startup
Event Triggered Execution
Hijack Execution Flow
Boot or Logon Autostart Execution
Server Software Component
Boot or Logon Initialization Scripts
Defense Evasion
Abuse Elevation Control Mechanism
System Binary Proxy Execution
Obfuscated Files or Information
Deobfuscate/Decode Files or Information
Process Injection
Impair Defenses
Hijack Execution Flow
Masquerading
XSL Script Processing
Hide Artifacts
References
All
Academic Paper
The following references were used to develop the Emulated File Analysis knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Network-level polymorphic shellcode detection using emulation
Reference Type: Academic Paper Author: Michalis Polychronakis