COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-421

Influence Perception of Authority

An adversary uses a social engineering technique to convey a sense of authority that motivates the target to reveal specific information or take specific action. There are various techniques for producing a sense of authority during ordinary modes of communication. One common method is impersonation. By impersonating someone with a position of power within an organization, an adversary may motivate the target individual to reveal some piece of sensitive information or perform an action that benefits the adversary.

Abstraction

Detailed

Typical severity

Low

Likelihood of attack

High

Understand the attack

What is this attack pattern?

An adversary uses a social engineering technique to convey a sense of authority that motivates the target to reveal specific information or take specific action. There are various techniques for producing a sense of authority during ordinary modes of communication. One common method is impersonation. By impersonating someone with a position of power within an organization, an adversary may motivate the target individual to reveal some piece of sensitive information or perform an action that benefits the adversary.

Requirements

What does the attack require?

Prerequisites

  • The adversary must have the means and knowledge of how to communicate with the target in some manner.

Skills required

  • Low: The adversary requires strong inter-personal and communication skills.

Resources required

  • None: No specialized resources are required to execute this type of attack.

Impact

What does a successful attack lead to?

Other

Affected scopes: Confidentiality, Integrity, Availability

Defence

How is it prevented and mitigated?

1
An organization should provide regular, robust cybersecurity training to its employees to prevent social engineering attacks.

Real world

MITRE example instances

Example instance 1Detail
The adversary calls the target and announces that they are the head of IT at the target's company. The adversary goes on to say that there has been a technical issue and they need the target's login credentials for their account. By convincing the target of their authority, the adversary hopes the target will reveal the sensitive information.