Executable Binary

Access Control Configuration

Access Control Group

Access Control List

Access Mediator

Access Process

Access Token

Activity Dependency

Actuator

Address Space

Administrative Network Traffic

Alias

Allocate Memory

Anonymous Pipe

Application

Application Configuration

Application Configuration Database

Application Configuration Database Record

Application Configuration File

Application Installer

Application Inventory Sensor

Application Layer Firewall

Application Layer Link

Application Process

Application Process Configuration

Application Rule

Application Shim

Archive File

Artifact Server

Asset Inventory Agent

Asymmetric Key

Audio Input Device

Authenticate User

Authentication Function

Authentication Log

Authentication Server

Authentication Service

Authorization Log

Authorization Service

Barcode Scanner Input Device

Binary Large Object

Binary Segment

Block Device

Boot Loader

Boot Record

Boot Sector

Browser

Browser Extension

Build Tool

Business Communication Platform Client

CA Certificate File

Processor Cache Memory

Call Stack

Central Processing Unit

Certificate

Certificate File

Certificate Trust Store

Chatroom Client

Child Process

Client Application

Client Computer

Clipboard

Cloud Configuration

Cloud Instance Metadata

Cloud Service Sensor

Cloud Storage

Cloud User Account

Code Analyzer

Code Repository

Collaborative Software

Network Agent

Command

Command History Log

Command History Log File

Command Line Interface

Compiler

Compiler Configuration File

Computer Network Node

Computer Platform

Computing Image

Computing Server

Computing Snapshot

Configuration Database

Configuration Database Record

Configuration File

Configuration Management Database

Configuration Resource

Connect Socket

Console Output Function

Container Build Tool

Container Image

Container Orchestration Software

Container Process

Container Runtime

Copy Memory Function

Copy Token

Create File

Create Process

Create Socket

Create Thread

Credential

Credential Management System

Cryptographic Key

Custom Archive File

Cyber Sensor

DHCP Network Traffic

DHCP Server

DNS Lookup

DNS Network Traffic

DNS Record

DNS Server

Data Artifact Server

Data Dependency

Data Link Link

Database

Database File

Database Query

Database Server

Decoy Artifact

Default User Account

Delete File

Dependency

Deserialization Function

Desktop Computer

Developer Application

Dial Up Modem

Differential Volume Snapshot

Digital Artifact

Digital Event Record

Digital Fingerprint

Digital Identity

Digital Information

Digital Information Bearer

Digital System

Properties

id: d3f:ExecutableBinary

name: Executable Binary
definition: An executable binary contains machine code instructions for a physical CPU. D3FEND also considers byte code for a virtual machine to be binary code. This is in contrast to executable scripts written in a scripting language.
see also: http://dbpedia.org/resource/Executable

json

Neighbors

        graph LR;

    d3f:Exec["Exec"] --> | executes | d3f:ExecutableBinary["Executable Binary"];
            class d3f:Exec inbound_node;
            style d3f:Exec fill:#fff4dd;
             class d3f:ExecutableBinary RootArtifactNode;
              style d3f:ExecutableBinary fill:#fff4dd;

            click d3f:Exec href "/dao/artifact/d3f:Exec";
            click d3f:ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";d3f:ExecutableFile["Executable File"] --> | contains | d3f:Subroutine["Subroutine"];
            class d3f:ExecutableFile inbound_node;
            style d3f:ExecutableFile fill:#fff4dd;
             d3f:ExecutableBinary["Executable Binary"] -.-> | contains | d3f:Subroutine["Subroutine"];
              class d3f:Subroutine inbound_node;
              style d3f:Subroutine fill:#fff4dd;

            click d3f:ExecutableFile href "/dao/artifact/d3f:ExecutableFile";
            click d3f:Subroutine href "/dao/artifact/d3f:Subroutine";d3f:Process["Process"] --> | process-image-path | d3f:ExecutableBinary["Executable Binary"];
            class d3f:Process inbound_node;
            style d3f:Process fill:#fff4dd;
             class d3f:ExecutableBinary RootArtifactNode;
              style d3f:ExecutableBinary fill:#fff4dd;

            click d3f:Process href "/dao/artifact/d3f:Process";
            click d3f:ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";d3f:SoftwareLibraryFile["Software Library File"] --> | may-contain | d3f:ExecutableBinary["Executable Binary"];
            class d3f:SoftwareLibraryFile inbound_node;
            style d3f:SoftwareLibraryFile fill:#fff4dd;
             class d3f:ExecutableBinary RootArtifactNode;
              style d3f:ExecutableBinary fill:#fff4dd;

            click d3f:SoftwareLibraryFile href "/dao/artifact/d3f:SoftwareLibraryFile";
            click d3f:ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary"; d3f:ExecutableBinary["Executable Binary"] --> | may-interpret | d3f:ExecutableScript["Executable Script"];
          class d3f:ExecutableBinary RootArtifactNode; class d3f:ExecutableScript ArtifactNode;
          click d3f:ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";
          click d3f:ExecutableScript href "/dao/artifact/d3f:ExecutableScript";d3f:ExecutableBinary["Executable Binary"] --> | contains | d3f:ImageCodeSegment["Image Code Segment"];
          class d3f:ExecutableBinary RootArtifactNode; class d3f:ImageCodeSegment ArtifactNode;
          click d3f:ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";
          click d3f:ImageCodeSegment href "/dao/artifact/d3f:ImageCodeSegment";d3f:ExecutableBinary["Executable Binary"] --> | contains | d3f:ImageDataSegment["Image Data Segment"];
          class d3f:ExecutableBinary RootArtifactNode; class d3f:ImageDataSegment ArtifactNode;
          click d3f:ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";
          click d3f:ImageDataSegment href "/dao/artifact/d3f:ImageDataSegment";  d3f:ExecutableBinary["Executable Binary"] --> | subClassOf | d3f:ExecutableFile["Executable File"];

          class d3f:ExecutableFile inbound_node;
          style d3f:ExecutableFile fill:#fff4dd;

          class d3f:ExecutableBinary RootArtifactNode;
          style d3f:ExecutableBinary fill:#fff4dd;

          click d3f:ExecutableFile href "/dao/artifact/d3f:ExecutableFile";
          click d3f:ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";

Inferred Relationships

This page is experimental and may change significantly in future releases.

Hierarchy

(filtered)

Related Countermeasure Techniques

        graph LR;

      DynamicAnalysis["Dynamic Analysis"] -->
          | analyzes | ExecutableFile["Executable File"]; class DynamicAnalysis DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click DynamicAnalysis href "/technique/d3f:DynamicAnalysis"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";EmulatedFileAnalysis["Emulated File Analysis"] -->
          | analyzes | ExecutableFile["Executable File"]; class EmulatedFileAnalysis DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click EmulatedFileAnalysis href "/technique/d3f:EmulatedFileAnalysis"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";ExecutableAllowlisting["Executable Allowlisting"] -->
          | blocks | ExecutableFile["Executable File"]; class ExecutableAllowlisting DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click ExecutableAllowlisting href "/technique/d3f:ExecutableAllowlisting"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";ExecutableDenylisting["Executable Denylisting"] -->
          | blocks | ExecutableFile["Executable File"]; class ExecutableDenylisting DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click ExecutableDenylisting href "/technique/d3f:ExecutableDenylisting"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | File["File"]; class RemoteFileAccessMediation DefensiveTechniqueNode; class File ArtifactNode; click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation"; click File href "/dao/artifact/d3f:File";DecoyFile["Decoy File"] -->
          | spoofs | File["File"]; class DecoyFile DefensiveTechniqueNode; class File ArtifactNode; click DecoyFile href "/technique/d3f:DecoyFile"; click File href "/dao/artifact/d3f:File";FileAnalysis["File Analysis"] -->
          | analyzes | File["File"]; class FileAnalysis DefensiveTechniqueNode; class File ArtifactNode; click FileAnalysis href "/technique/d3f:FileAnalysis"; click File href "/dao/artifact/d3f:File";FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | File["File"]; class FileIntegrityMonitoring DefensiveTechniqueNode; class File ArtifactNode; click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring"; click File href "/dao/artifact/d3f:File";FileEviction["File Eviction"] -->
          | deletes | File["File"]; class FileEviction DefensiveTechniqueNode; class File ArtifactNode; click FileEviction href "/technique/d3f:FileEviction"; click File href "/dao/artifact/d3f:File";FileEncryption["File Encryption"] -->
          | encrypts | File["File"]; class FileEncryption DefensiveTechniqueNode; class File ArtifactNode; click FileEncryption href "/technique/d3f:FileEncryption"; click File href "/dao/artifact/d3f:File";LocalFilePermissions["Local File Permissions"] -->
          | restricts | File["File"]; class LocalFilePermissions DefensiveTechniqueNode; class File ArtifactNode; click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; click File href "/dao/artifact/d3f:File";RestoreFile["Restore File"] -->
          | restores | File["File"]; class RestoreFile DefensiveTechniqueNode; class File ArtifactNode; click RestoreFile href "/technique/d3f:RestoreFile"; click File href "/dao/artifact/d3f:File";

Related Weaknesses

ExecutableBinary has no related weaknesses in this release.

Related Offensive Techniques

        graph LR;

    T1055003["Thread Execution Hijacking"] --> |may-add| ExecutableBinary["Executable Binary"]; class T1055003 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1055003 href "/offensive-technique/attack/T1055.003/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1546006["LC_LOAD_DYLIB Addition"] --> |modifies| ExecutableBinary["Executable Binary"]; class T1546006 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1546006 href "/offensive-technique/attack/T1546.006/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1546008["Accessibility Features"] --> |may-modify| ExecutableBinary["Executable Binary"]; class T1546008 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1546008 href "/offensive-technique/attack/T1546.008/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1546015["Component Object Model Hijacking"] --> |loads| ExecutableBinary["Executable Binary"]; class T1546015 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1546015 href "/offensive-technique/attack/T1546.015/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1027001["Binary Padding"] --> |modifies| ExecutableBinary["Executable Binary"]; class T1027001 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1027001 href "/offensive-technique/attack/T1027.001/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1036001["Invalid Code Signature"] --> |creates| ExecutableBinary["Executable Binary"]; class T1036001 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1036001 href "/offensive-technique/attack/T1036.001/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";