Esc
File Metadata Value Verification
Definition
The process of checking specific static values within a file, such as file signatures or magic numbers, to ensure they match the expected values defined by the file format specification.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 2 techniques in this category, File Metadata Value Verification.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| File Metadata Value Verification | D3-FMVV | The process of checking specific static values within a file, such as file signatures or magic numbers, to ensure they match the expected values defined by the file format specification. | |
| - File Magic Byte Verification | D3-FMBV | Utilizing the magic number to verify the file |
Related Offensive Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Execution
Hijack Execution Flow
Command and Scripting Interpreter
Scheduled Task/Job
Trusted Developer Utilities Proxy Execution
User Execution
Software Deployment Tools
Persistence
Office Application Startup
Event Triggered Execution
Modify Authentication Process
Boot or Logon Autostart Execution
Create or Modify System Process
Scheduled Task/Job
Boot or Logon Initialization Scripts
Server Software Component
Stealth
XSL Script Processing
Process Injection
System Binary Proxy Execution
Hijack Execution Flow
Rootkit
Masquerading
Obfuscated Files or Information
Hide Artifacts
Impair Defenses
Trusted Developer Utilities Proxy Execution
Deobfuscate/Decode Files or Information
Indicator Removal
Privilege Escalation
Event Triggered Execution
Process Injection
Boot or Logon Autostart Execution
Create or Modify System Process
Scheduled Task/Job
Boot or Logon Initialization Scripts
Abuse Elevation Control Mechanism
Credential Access
Modify Authentication Process
Credentials from Password Stores
OS Credential Dumping
Forced Authentication
Unsecured Credentials
Steal or Forge Authentication Certificates
Defense Impairment
Modify Authentication Process
Collection
Archive Collected Data
Data from Local System
Email Collection
Automated Collection
Data Staged
Discovery
System Owner/User Discovery
Remote System Discovery
System Network Configuration Discovery
File and Directory Discovery
Command and Control
Encrypted Channel
Application Layer Protocol
Exfiltration
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
Lateral Movement
Internal Spearphishing
Software Deployment Tools
References
All
Academic Paper
Book
The following references were used to develop the File Metadata Value Verification knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Carving Contiguous and Fragmented Files with Fast Object Validation
Reference Type: Academic Paper Author: Simson L. Garfinkel
Introductory Computer Forensics
Reference Type: Book Author: Xiaodong Lin