D3-EFA

Emulated File Analysis

Description

Emulating instructions in a file looking for specific patterns.

Mapped SPARTA techniques

No techniques mapped to this control.

Cross-framework references

Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.

Counters 38 in MITRE ATT&CK Enterprise

T1016 System Network Configuration Discovery
T1027.001 Binary Padding
T1027.002 Software Packing
T1027.004 Compile After Delivery
T1036.001 Invalid Code Signature
T1036.003 Rename Legitimate Utilities
T1037.001 Logon Script (Windows)
T1037.002 Login Hook
T1037.003 Network Logon Script
T1037.004 RC Scripts
T1055.003 Thread Execution Hijacking
T1059 Command and Scripting Interpreter
T1114.001 Local Email Collection
T1137.001 Office Template Macros
T1137.003 Outlook Forms
T1140 Deobfuscate/Decode Files or Information
T1204.002 Malicious File
T1218.005 Mshta
T1220 XSL Script Processing
T1505.003 Web Shell
T1534 Internal Spearphishing
T1546.002 Screensaver
T1546.005 Trap
T1546.006 LC_LOAD_DYLIB Addition
T1546.008 Accessibility Features
T1546.013 PowerShell Profile
T1546.015 Component Object Model Hijacking
T1547.001 Registry Run Keys / Startup Folder
T1547.009 Shortcut Modification
T1548.002 Bypass User Account Control
T1562.003 Impair Command History Logging
T1564.007 VBA Stomping
T1565.003 Runtime Data Manipulation
T1566.001 Spearphishing Attachment
T1566.002 Spearphishing Link
T1574.007 Path Interception by PATH Environment Variable
T1574.008 Path Interception by Search Order Hijacking
T1574.009 Path Interception by Unquoted Path

Cite as SafeMode Space, d3fend D3-EFA.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

# Description

›Mapped SPARTA techniques

›Cross-framework references

Counters 38 in MITRE ATT&CK Enterprise

Description

Mapped SPARTA techniques

Cross-framework references