| ID | Name |
|---|---|
| T1696.001 | Automate CAPTCHA Completion |
| T1696.002 | Avoid CAPTCHA |
Adversaries may attempt to use bots to successfully solve CAPTCHA challenges. CAPTCHA challenges are typically used by defenders to detect and prevent bot and spam traffic from accessing protected webpages. CAPTCHAs are automated tests often placed before login screens or form fields. Traditional CAPTCHAs ask the user to decipher a string of characters, type the characters into a box, and submit the form. reCAPTCHA asks the user to identify images, click a checkbox, or evaluate the user’s behavior from mouse movement and device cookies.[1]
Adversaries may use scripts or toolkits to automatically solve the CAPTCHA puzzle. For example, adversaries may develop a script that uses the ImageMagick toolkit to solve the CAPTCHA puzzles to then create multiple valid accounts. ImageMagick tool can convert the images into a RGB complemented image. The CAPTCHA challenge may be solved by identifying and comparing attributes of the RGB images to select the expected image.[2] Once the CAPTCHA challenge is solved, the adversary’s script may access the protected page. After accessing the protected the page, the adversary may submit valid forms to the target.
| ID | Mitigation | Description |
|---|---|---|
| M1037 | Filter Network Traffic |
Do not treat successful CAPTCHA completion alone as sufficient evidence that subsequent activity is human-generated. Continue evaluating requests using bot classification, request rate, client/session characteristics, token reuse, source reputation, and behavioral signals after successful challenge completion. Block or rate-limit activity that remains inconsistent with expected human use. |
| M1031 | Network Intrusion Prevention |
Configure inline bot-management and web application protections to continue enforcing automation controls after a client successfully completes a CAPTCHA. Use challenge-token state as one input rather than as a durable trust determination, and prevent requests that subsequently exhibit automated or abusive behavior. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0937 | Detection of Automated CAPTCHA | AN2104 |
Successful CAPTCHA completion does not expose whether the challenge was solved manually, through automated tooling, through an AI-enabled solver, or through a third-party human-solving service. Providers may independently classify associated sessions as automated or bot-like, but this identifies suspicious automation rather than the method used to complete the CAPTCHA. |