COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-549

Local Execution of Code

An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.

Abstraction

Meta

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.

Requirements

What does the attack require?

Prerequisites

  • Knowledge of the target system's vulnerabilities that can be capitalized on with malicious code.The adversary must be able to place the malicious code on the target system.

Skills required

Not stated in the MITRE record.

Resources required

  • The means by which the adversary intends to place the malicious code on the system dictates the tools required. For example, suppose the adversary wishes to leverage social engineering and convince a legitimate user to open a malicious file attached to a seemingly legitimate email. In this case, the adversary might require a tool capable of wrapping malicious code into an innocuous filetype (e.g., PDF, .doc, etc.)

Impact

What does a successful attack lead to?

Execute Unauthorized Commands

Affected scopes: Confidentiality, Integrity, Availability

Other

Affected scopes: Confidentiality, Integrity, Availability

Defence

How is it prevented and mitigated?

1
Employ robust cybersecurity training for all employees.
2
Implement system antivirus software that scans all attachments before opening them.
3
Regularly patch all software.
4
Execute all suspicious files in a sandbox environment.

Real world

MITRE example instances

Example instance 1Detail
BlueBorne refers to a set of nine vulnerabilities on different platforms (Linux, Windows, Android, iOS) that offer an adversary the ability to install and execute malicious code on a system if they were close in proximity to a Bluetooth enabled device. One vulnerability affecting iOS versions 7 through 9 allowed an attacker to overflow the Low Energy Audio Protocol since commands sent over this protocol are improperly validated and gain the elevated permissions of the Bluetooth stack. These vulnerabilities were a result of poor validation and were patched shortly after their exposure in 2017, but many non-updated devices remain vulnerable.
CAPEC-549: Local Execution of Code — DayBreach Saldırı Sözlüğü · DayBreach