3. The method of claim 1 , wherein the extracted characteristics are selected from the group consisting of: an author mark, a tool mark, a behavior, a pattern, and a text sequence.
1. A method for use in analyzing executable content within at least one network of an enterprise, the method comprising: receiving multiple instances of executable content at a central analysis server over at least one network of an enterprise via at least one of a plurality of collection agents disposed within the at least one network, the at least one of the plurality of collection agents remote from and in operative communication with the central analysis server; extracting, by a hardware processor of the central analysis server, one or more characteristics from each instance of the received executable content; identifying, by the hardware processor, associations among the extracted characteristics; determining, based on the associations among the extracted characteristics, that a first portion of executable content is associated with a non-trusted entity; obtaining a hash value of the first portion of executable content and storing the hash value and the associated extracted characteristics to create a non-trusted entity profile; storing the extracted characteristics, identified associations, and hash value in a database of the central analysis server, the database accessible by the plurality of collection agents such that each of the plurality of collection agents is operable to identify at least another portion of executable content associated with the non-trusted entity based on the hash value that has been recognized and presented in the database; and receiving, by the central analysis server, an indication of notice from one of the plurality of collection agents indicative of a detection of the at least another portion of executable content associated with the non-trusted entity at the one of the plurality of collection agents, the indication comprising the hash value, location information but not a copy of the at least another portion of executable content to limit use of enterprise infrastructure resources and so as to update the non-trusted entity profile.