COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-655

Avoid Security Tool Identification by Adding Data

An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions. In addition to this, adding data to a file also changes the file's hash, frustrating security tools that look for known bad files by their hash.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions. In addition to this, adding data to a file also changes the file's hash, frustrating security tools that look for known bad files by their hash.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • Target application or infrastructure exposes an exploitable vulnerability surface.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Hide ActivitiesBypass Protection Mechanism

Etkilenen alanlar: Accountability

Modify Data

Etkilenen alanlar: Integrity

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
Adding data to change the checksum of a file and can be used to avoid hash-based denylists and static anti-virus signatures.
CAPEC-655: Avoid Security Tool Identification by Adding Data — DayBreach Saldırı Sözlüğü · DayBreach