MITRE D3FENDdefensive technique

D3-FMCV File Metadata Consistency Validation

Official page ↗
Tactic
Isolate

Definition

The process of validating the consistency between a file's metadata and its actual content, ensuring that elements like declared lengths, pointers, and checksums accurately describe the file's content.

How it works

How it works This technique involves validating the consistency between a file's metadata and its actual content. It checks elements like declared lengths, pointers, and checksums to ensure they accurately describe the file's content. For instance, if a header specifies a content block of 50 bytes, this should be verified, and CRC values should be recalculated and compared.

Related

Child of · MITRE D3FEND (1)

  • D3-FFV File Format Verification defensive technique

References