Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems.[1]
Adversaries may inject content to victim systems in various ways, including:
Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."[3][1][4]
| ID | Name | Description |
|---|---|---|
| S1088 | Disco |
Disco has achieved initial access and execution through content injection into DNS, HTTP, and SMB replies to targeted hosts that redirect them to download malicious files.[5] |
| G1019 | MoustachedBouncer |
MoustachedBouncer has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.[5] |
| ID | Mitigation | Description |
|---|---|---|
| M1041 | Encrypt Sensitive Information |
Where possible, ensure that online traffic is appropriately encrypted through services such as trusted VPNs. |
| M1021 | Restrict Web-Based Content |
Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0022 | File | File Creation |
Monitor for unexpected and abnormal file creations that may indicate malicious content injected through online network communications. |
| DS0029 | Network Traffic | Network Traffic Content |
Monitor for other unusual network traffic that may indicate additional malicious content transferred to the system. Use network intrusion detection systems, sometimes with SSL/TLS inspection, to look for known malicious payloads, content obfuscation, and exploit code. |
| DS0009 | Process | Process Creation |
Look for behaviors on the endpoint system that might indicate successful compromise, such as abnormal behaviors of browser processes. This could include suspicious files written to disk, evidence of Process Injection for attempts to hide execution, or evidence of Discovery. |