File Metadata Consistency Validation
Definition
The process of validating the consistency between a file's metadata and its actual content, ensuring that elements like declared lengths, pointers, and checksums accurately describe the file's content.
How it works
This technique involves validating the consistency between a file's metadata and its actual content. It checks elements like declared lengths, pointers, and checksums to ensure they accurately describe the file's content. For instance, if a header specifies a content block of 50 bytes, this should be verified, and CRC values should be recalculated and compared.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Related ATT&CK Techniques:
These offensive techniques are determined related because of the way this defensive technique,, , , and .
References
The following references were used to develop the File Metadata Consistency Validation knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)