Esc
Content Filtering
Definition
Content Filtering techniques aid in the process of analyzing an input file for malicious or erroneous content and outputing a sanitized version.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 14 techniques in this category, Content Filtering.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Content Filtering | D3-CF | Content Filtering techniques aid in the process of analyzing an input file for malicious or erroneous content and outputing a sanitized version. | |
| - File Format Verification | D3-FFV | Verifying that a file conforms to its expected format specifications | |
| - File Metadata Consistency Validation | D3-FMCV | The process of validating the consistency between a file's metadata and its actual content, ensuring that elements like declared lengths, pointers, and checksums accurately describe the file's content. | |
| - File Metadata Value Verification | D3-FMVV | The process of checking specific static values within a file, such as file signatures or magic numbers, to ensure they match the expected values defined by the file format specification. | |
| - Content Rebuild | D3-CNR | Rebuild the file according to the spec so any unreferenced components or objects are removed. | Content Reconstruction |
| - File Content Decompression Checking | D3-FCDC | Checking if compressed or encoded data sections can be successfully decompressed or decoded. Can follow with further analysis with semantic knowledge | |
| - Content Format Conversion | D3-CFC | Content format conversion is mechanical transformation from one format to another which may be normalization or specifically flattening. | |
| - Content Quarantine | D3-CQ | Transfer content that does not comply with policy to a quarantine zone. | |
| - Content Excision | D3-CNE | Removing specific, potentially malicious, parts of content | |
| - File Internal Structure Verification | D3-FISV | The process of checking specific static values within a file, such as file signatures or magic numbers, to ensure they match the expected values defined by the file format specification. | |
| - Content Validation | D3-CV | Verify and validate contents complies with policy | |
| - File Magic Byte Verification | D3-FMBV | Utilizing the magic number to verify the file | |
| - Content Substitution | D3-CNS | Modifies specific digital content information by replacing it with something else. | |
| - Content Modification | D3-CM | Modify content that does not comply with policy. |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Lateral Movement
Software Deployment Tools
Internal Spearphishing
Privilege Escalation
Abuse Elevation Control Mechanism
Process Injection
Boot or Logon Autostart Execution
Event Triggered Execution
Hijack Execution Flow
Create or Modify System Process
Scheduled Task/Job
Boot or Logon Initialization Scripts
Command And Control
Encrypted Channel
Application Layer Protocol
Impact
Data Encrypted for Impact
Data Manipulation
Collection
Automated Collection
Data Staged
Archive Collected Data
Data from Local System
Email Collection
Discovery
System Network Configuration Discovery
Software Discovery
Remote System Discovery
System Owner/User Discovery
File and Directory Discovery
Persistence
Boot or Logon Autostart Execution
Office Application Startup
Event Triggered Execution
Hijack Execution Flow
Modify Authentication Process
Create or Modify System Process
Scheduled Task/Job
Server Software Component
Boot or Logon Initialization Scripts
Execution
Software Deployment Tools
User Execution
Command and Scripting Interpreter
Scheduled Task/Job
Credential Access
Unsecured Credentials
Modify Authentication Process
OS Credential Dumping
Forced Authentication
Credentials from Password Stores
Steal or Forge Authentication Certificates
Defense Evasion
Abuse Elevation Control Mechanism
Indicator Removal
Masquerading
System Binary Proxy Execution
Process Injection
Obfuscated Files or Information
Hide Artifacts
Trusted Developer Utilities Proxy Execution
Hijack Execution Flow
Deobfuscate/Decode Files or Information
Modify Authentication Process
Rootkit
Impair Defenses
Subvert Trust Controls
XSL Script Processing
Exfiltration
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
References
All
Patent
The following references were used to develop the Content Filtering knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Method For Content Disarm and Reconstruction
Reference Type: Patent Organization: OPSWAT, Inc. Author: Taeil Goh, Vinh Nguyen Xuan Lam, Nhut Minh Ngo, Dung Huu Nguyen