D3-FCDC — File Content Decompression Checking
D3-FCDC: File Content Decompression Checking
MITRE D3FEND countermeasure
What it does
Checking if compressed or encoded data sections can be successfully decompressed or decoded. Can follow with further analysis with semantic knowledge
Attacks this counters
No ATT&CK technique in this corpus maps to this countermeasure. D3FEND may map it to techniques outside the Enterprise matrix, or to ones MITRE has since revoked — absence here is about this corpus, not about the countermeasure.