COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-549

Local Execution of Code

An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.

Soyutlama

Meta

Tipik ciddiyet

High

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • Knowledge of the target system's vulnerabilities that can be capitalized on with malicious code.The adversary must be able to place the malicious code on the target system.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

  • The means by which the adversary intends to place the malicious code on the system dictates the tools required. For example, suppose the adversary wishes to leverage social engineering and convince a legitimate user to open a malicious file attached to a seemingly legitimate email. In this case, the adversary might require a tool capable of wrapping malicious code into an innocuous filetype (e.g., PDF, .doc, etc.)

Etki

Başarılı saldırı neye yol açar?

Execute Unauthorized Commands

Etkilenen alanlar: Confidentiality, Integrity, Availability

Other

Etkilenen alanlar: Confidentiality, Integrity, Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Employ robust cybersecurity training for all employees.
2
Implement system antivirus software that scans all attachments before opening them.
3
Regularly patch all software.
4
Execute all suspicious files in a sandbox environment.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
BlueBorne refers to a set of nine vulnerabilities on different platforms (Linux, Windows, Android, iOS) that offer an adversary the ability to install and execute malicious code on a system if they were close in proximity to a Bluetooth enabled device. One vulnerability affecting iOS versions 7 through 9 allowed an attacker to overflow the Low Energy Audio Protocol since commands sent over this protocol are improperly validated and gain the elevated permissions of the Bluetooth stack. These vulnerabilities were a result of poor validation and were patched shortly after their exposure in 2017, but many non-updated devices remain vulnerable.
CAPEC-549: Local Execution of Code — DayBreach Saldırı Sözlüğü · DayBreach