Get a summary of all MITRE ATT&CK techniques observed in each of the sandbox reports of a file.

External Documentation

To learn more, visit the VirusTotal documentation.

Parameters

ParameterDescription
File HashThe SHA-256, SHA-1 or MD5 identifying the file.

Example Output

{
	"data": {
		"SecurityAnalyzer Pro": {
			"tactics": []
		},
		"DefendBox": {
			"tactics": [
				{
					"description": "The application is attempting to understand system configurations.\n\nConfiguration analysis includes techniques that software may use to gather information about system settings and network architecture. These techniques help applications evaluate the environment and determine appropriate actions. They enable the software to identify available resources and permissions around the entry point to optimize performance and functionality.",
					"techniques": [
						{
							"description": "The application may collect system configuration details including hardware specifications, installed software versions, and resource availability. This information helps determine compatibility and resource requirements.\nStandard system commands can retrieve configuration data. On privileged accounts, detailed hardware information can be accessed through system management tools. For example, users can check storage capacity using built-in disk utilities. Applications may also use authenticated API calls to cloud platforms to gather instance metadata and status information.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Checks system configurations"
								}
							],
							"link": "https://example.com/techniques/TC001",
							"id": "TC001",
							"name": "Configuration Analysis"
						},
						{
							"description": "The software examines file system structure and contents to understand data organization. This helps optimize data access patterns and storage usage.\nBuilt-in file system tools provide directory listings and metadata. Custom modules may interface directly with system APIs for enhanced file system interaction.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Scans directory structure"
								}
							],
							"link": "https://example.com/techniques/TC002",
							"id": "TC002",
							"name": "Storage Analysis"
						}
					],
					"link": "https://example.com/tactics/TA001",
					"id": "TA001",
					"name": "System Analysis"
				},
				{
					"description": "The application implements security best practices.\n\nSecurity hardening consists of techniques that software uses to protect system integrity and prevent unauthorized access. These methods include input validation, secure communication, and access control enforcement.",
					"techniques": [
						{
							"description": "The application validates and sanitizes all inputs to prevent injection attacks and ensure data integrity. This includes checking data types, formats, and ranges before processing.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Validates input parameters"
								}
							],
							"link": "https://example.com/techniques/TC003",
							"id": "TC003",
							"name": "Input Validation"
						},
						{
							"description": "The software implements secure coding practices to protect sensitive data and prevent unauthorized access. This includes proper error handling and secure storage of credentials.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Implements security controls"
								}
							],
							"link": "https://example.com/techniques/TC004",
							"id": "TC004",
							"name": "Secure Implementation"
						}
					],
					"link": "https://example.com/tactics/TA002",
					"id": "TA002",
					"name": "Security Hardening"
				},
				{
					"description": "The application manages access permissions appropriately.\n\nAccess control ensures that operations are performed with appropriate privileges. This includes checking user permissions, managing authentication, and implementing principle of least privilege.",
					"techniques": [
						{
							"description": "The software implements robust authentication mechanisms and validates user permissions before performing privileged operations. Access levels are carefully managed and monitored.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Checks access permissions"
								}
							],
							"link": "https://example.com/techniques/TC005",
							"id": "TC005",
							"name": "Permission Management"
						}
					],
					"link": "https://example.com/tactics/TA003",
					"id": "TA003",
					"name": "Access Control"
				}
			]
		},
		"SecurityGuard Basic": {
			"tactics": []
		}
	},
	"links": {
		"self": "https://api.example.com/v1/analysis/abc123/security_analysis"
	}
}

Workflow Library Example

Get File Mitre Attandck Techniques with Virustotal and Send Results Via Email

Preview this Workflow on desktop