COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-655

Avoid Security Tool Identification by Adding Data

An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions. In addition to this, adding data to a file also changes the file's hash, frustrating security tools that look for known bad files by their hash.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

High

Understand the attack

What is this attack pattern?

An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions. In addition to this, adding data to a file also changes the file's hash, frustrating security tools that look for known bad files by their hash.

Requirements

What does the attack require?

Prerequisites

  • Target application or infrastructure exposes an exploitable vulnerability surface.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Hide ActivitiesBypass Protection Mechanism

Affected scopes: Accountability

Modify Data

Affected scopes: Integrity

Real world

MITRE example instances

Example instance 1Detail
Adding data to change the checksum of a file and can be used to avoid hash-based denylists and static anti-virus signatures.