Esc
File Magic Byte Verification
Definition
Utilizing the magic number to verify the file
How it works
Many file formats use magic numbers to identify a file format or protocol. Verifying that the magic number matches the expected value of its declared format is a simple way of verifying the file format.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Lateral Movement
Software Deployment Tools
Internal Spearphishing
Privilege Escalation
Abuse Elevation Control Mechanism
Process Injection
Boot or Logon Autostart Execution
Event Triggered Execution
Hijack Execution Flow
Create or Modify System Process
Scheduled Task/Job
Boot or Logon Initialization Scripts
Command And Control
Encrypted Channel
Application Layer Protocol
Impact
Data Encrypted for Impact
Data Manipulation
Collection
Automated Collection
Data Staged
Archive Collected Data
Data from Local System
Email Collection
Discovery
System Network Configuration Discovery
Remote System Discovery
System Owner/User Discovery
File and Directory Discovery
Persistence
Office Application Startup
Boot or Logon Autostart Execution
Event Triggered Execution
Hijack Execution Flow
Modify Authentication Process
Create or Modify System Process
Scheduled Task/Job
Server Software Component
Boot or Logon Initialization Scripts
Execution
Software Deployment Tools
User Execution
Command and Scripting Interpreter
Scheduled Task/Job
Credential Access
Unsecured Credentials
Modify Authentication Process
OS Credential Dumping
Forced Authentication
Credentials from Password Stores
Steal or Forge Authentication Certificates
Defense Evasion
Abuse Elevation Control Mechanism
Indicator Removal
Masquerading
Process Injection
System Binary Proxy Execution
Obfuscated Files or Information
Hide Artifacts
Trusted Developer Utilities Proxy Execution
Hijack Execution Flow
Deobfuscate/Decode Files or Information
Modify Authentication Process
Rootkit
Impair Defenses
XSL Script Processing
Exfiltration
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
References
All
Academic Paper
The following references were used to develop the File Magic Byte Verification knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Carving Contiguous and Fragmented Files with Fast Object Validation
Reference Type: Academic Paper Author: Simson L. Garfinkel
Gathering Evidence: Model-Driven Software Engineering in Automated Digital Forensics
Reference Type: Academic Paper Author: van den Bos, J.