COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-529

Malware-Directed Internal Reconnaissance

Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.

Abstraction

Standard

Typical severity

Medium

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.

Requirements

What does the attack require?

Prerequisites

  • The adversary must have internal, logical access to the target network and system.

Skills required

  • Medium: The adversary must be able to obtain or develop, as well as place malicious software inside the target network/system.

Resources required

  • The adversary requires a variety of tools to collect information about the target. These include port/network scanners and tools to analyze responses from applications to determine version and configuration information. Footprinting a system adequately may also take a few days if the attacker wishes the footprinting attempt to go undetected.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Defence

How is it prevented and mitigated?

1
Keep patches up to date by installing weekly or daily if possible.
2
Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
CAPEC-529: Malware-Directed Internal Reconnaissance — DayBreach Saldırı Sözlüğü · DayBreach