File-based IOCs
No matter what collection methodology is used to obtain unknown files, your organization can utilize several file analysis techniques to examine them. These techniques help derive file artifacts that can be used to determine the maliciousness of the file. Additionally, these file artifacts can be IOCs themselves or can help you generate file-based IOCs that can be used to identify the file or artifacts of the file's execution. These artifacts and IOCs can even be used to block activity on the endpoint or in the network; detection would mean that the file is successfully executed in your organization's environment.
File analysis techniques fall into three main categories:
- Static tool analysis: This type of file analysis means that the researcher is focusing on what the file is. If it is harmful or malicious, any intelligence value that's provided by utilizing a software application or tool that derives artifacts and IOCs can be used to determine...
