Workspace

Explore

Questions the demo answers about the public specimen TB-3C69C44F01558D99 (invoice_sept_update.exe). Pick one to open it in the question box.

Triage

What the file is, how confident the verdict is, and how urgent it is.

  • What is TB-3C69C44F01558D99, and how worried should we be?
  • Is TB-3C69C44F01558D99 malicious?
  • Is the file's signature still valid?

Behaviour

What happens when it runs, mapped to MITRE ATT&CK techniques.

  • Walk me through what it does once it runs.
  • Which ATT&CK techniques does it use?
  • How does it persist and where does it beacon?

Response

Containment steps for analyst approval. VECTOR SI never acts on its own.

  • What should we do to contain it?
  • Which indicators should we block?

The model

What VECTOR SI is and where each version stands.

  • What can VECTOR SI do today?
  • What is on the VECTOR SI roadmap?