COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-529

Malware-Directed Internal Reconnaissance

Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.

Soyutlama

Standard

Tipik ciddiyet

Medium

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The adversary must have internal, logical access to the target network and system.

Gerekli beceri

  • Medium: The adversary must be able to obtain or develop, as well as place malicious software inside the target network/system.

Gerekli kaynak

  • The adversary requires a variety of tools to collect information about the target. These include port/network scanners and tools to analyze responses from applications to determine version and configuration information. Footprinting a system adequately may also take a few days if the attacker wishes the footprinting attempt to go undetected.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Keep patches up to date by installing weekly or daily if possible.
2
Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
CAPEC-529: Malware-Directed Internal Reconnaissance — DayBreach Saldırı Sözlüğü · DayBreach