COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-571

Block Logging to Central Repository

An adversary prevents host-generated logs being delivered to a central location in an attempt to hide indicators of compromise.

Soyutlama

Standard

Tipik ciddiyet

Low

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary prevents host-generated logs being delivered to a central location in an attempt to hide indicators of compromise.

Genişletilmiş açıklama

In the case of network based reporting of indicators, an adversary may block traffic associated with reporting to prevent central station analysis. This may be accomplished by many means such as stopping a local process to creating a host-based firewall rule to block traffic to a specific server. In the case of local based reporting of indicators, an adversary may block delivery of locally-generated log files themselves to the central repository.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • Target application or infrastructure exposes an exploitable vulnerability surface.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

MITRE kaydında belirtilmemiş.