D3fend Detect

D3FEND — Detect

When to Use

• Building file analysis pipelines (static, dynamic, emulated)
• Implementing identifier reputation checks (IP, domain, file hash, URL)
• Designing network traffic analysis and anomaly detection
• Monitoring platform health (OS, firmware, applications)
• Setting up physical access controls and surveillance
• Creating file integrity and behavioral monitoring

When NOT to Use

• System hardening or secure configuration → d3fend-harden
• Network segmentation or access mediation → d3fend-isolate
• Honeypots or decoy operations → d3fend-deceive
• Threat hunting playbooks → defensive-security-analyst
• SIEM/SOAR engineering → cybersecurity

Core Workflows

1. File Analysis

See `references/file_analysis.md`

2. Identifier & Reputation Analysis

• IP reputation (blocklists, geo, ASN)
• Domain reputation (age, DGA, homoglyphs)
• File hash reputation (VT, local DB)
• URL analysis (phishing, redirect chains)
• Sender/MTP reputation (SPF, DKIM, DMARC)

See `references/identifier_reputation.md`

3. Network Traffic Analysis

• Protocol command analysis (DNS, HTTP, RPC, IPC)
• Payload profiling and byte sequence emulation
• Certificate analysis (active/passive)
• Connection attempt and session volume analysis
• Community deviation and signature matching

See `references/network_traffic.md`

4. Platform & Physical Monitoring

• File integrity monitoring (FIM)
• Firmware behavior analysis and verification
• OS and application performance/exception monitoring
• Scheduled job and system daemon monitoring
• Physical: electronic locks, motion, video, proximity

See `references/platform_monitoring.md`

When to load references

• File analysis → references/file_analysis.md
• Identifier reputation → references/identifier_reputation.md
• Network traffic → references/network_traffic.md
• Platform monitoring → references/platform_monitoring.md

File Analysis

Technique Coverage

Analysis Stack

Static Analysis

Dynamic Analysis

Sandbox: Cuckoo, ANY.RUN, Hybrid Analysis
Monitor: API calls, registry, files, network
Duration: 2-5 minutes typical
Report: Behavior summary, IOC extraction

Emulated Analysis

Engine: Speakeasy, Unicorn, Binee
Advantage: No full VM overhead
Use: Quick triage, API log extraction
Limitation: Anti-emulation evasion

Integration

# Automated pipeline
file_received → hash_lookup → yara_scan → 
    if suspicious → sandbox → report
    if clean → release

Identifier Reputation Analysis

Technique Coverage

Reputation Sources

Homoglyph Detection

# Detect unicode spoofing
def detect_homoglyphs(domain):
    confusables = {
        'а': 'a',  # Cyrillic а vs Latin a
        'е': 'e',
        'о': 'o',
    }
    # Normalize and compare

Scoring

Integration

• DNS firewalls: block known malicious domains
• Email gateways: reject known bad senders
• Web proxies: block malicious URLs
• EDR: alert on known bad file hashes

Network Traffic Analysis

Technique Coverage

Detection Methods

Signature-based

SNORT/Suricata rules for known threats
YARA over network payloads
Custom IDS rules for IOCs

Anomaly-based

Baseline: normal traffic patterns per host/subnet
Deviation: unusual volume, protocols, destinations
Machine learning: auto-encoder, clustering

Protocol Analysis

DNS: DGA detection, tunneling, unusual queries
HTTP: C2 beaconing, data exfiltration
TLS: JA3 fingerprinting, SNI analysis
SMB: lateral movement, suspicious shares

Tools

• Zeek, Suricata, Snort
• Wireshark, tshark
• Arkime (Moloch), Corelight
• Vectra, Darktrace

Platform & Physical Monitoring

Technique Coverage

Platform Monitoring Stack

File Integrity Monitoring

Baseline: Known-good file hashes
Frequency: Real-time or periodic
Alerts: Unexpected changes, new files, deletions
Scope: Critical system files, configs, executables

Physical Security

Firmware Monitoring

• Boot integrity measurement (TPM)
• Runtime behavior analysis
• Update verification (signed updates)
• Embedded monitoring code