Going Beyond Files: Destructive Object Analysis
Before we dive into outlining all the horrors of destructive objects, let's clarify an important point: File-level insights are still incredibly valuable to threat hunters. But files aren't the only way to sneak malware into your business - and so, file-level detection can't be the only type of visibility your security teams seek. In fact, that's the primary reason insights into objects is a critical piece of creating a stable security posture: if you don't have that level of visibility, you're missing vector after vector, likely never reaching the potential of a given detection and mitigation strategy.
Destructive objects, in short, are vulnerable and malware-infected destructive files, emails, attachments, binaries, and third-party and open source code snippets, typically packed together, e.g. a hidden active script and URL inside a PDF file or an impersonated certificate within digitally signed files. With that in mind, let's review some of the other key reasons destructive object insight - that is, insight beyond files - is critical to your security success.
1. Executables Only: A Thing of the Past
In traditional security protocols, running executables in a sandbox proved its value time after time. But, as they always do, threat actors adapted. Knowing that security teams expect to run malicious executables in a sandbox environment, these actors began to create workarounds. Beyond simple hang times (to wait out the patience of the employee running the file), they moved toward hiding malware in other shapes, giving it other properties — the kind that would never make it into the sandbox in the first place. If the protocol existed for a set of given file formats, the threats would materialize in a new or different format. If you've covered all executables, and all files are being pulled from the hard drive and then executed from the write to memory....well, you see where this is going. Why not skip the hard drive step?
In summary, executable-only detection measures aren't enough for slippery threats. Once they were ubiquitous, the landscape shifted. Object-level insight became invaluable.
2. Phishing: A Thing of the Present
Though phishing has always been a favorite attack vector for the inept and highly adept threat actor alike, it may seem that a decline in executable-only mentality would keep malware files out of your employees' inboxes. Not the case. Indeed, according to the 2019 Verizon Data Breach Investigation Report, 92 percent of malware is still delivered by email, making it the most common vector for malware there is.
