CAPEC-122: Privilege Abuse
Description
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
- Likelihood of attack
- High
- Typical severity
- Medium
- Abstraction
- MetaA decidedly abstract characterisation of a methodology or technique.
Mechanism of attack: Subvert Access Control
Prerequisites
- The target must have misconfigured their access control mechanisms such that sensitive information, which should only be accessible to more trusted users, remains accessible to less trusted users.
- The adversary must have access to the target, albeit with an account that is less privileged than would be appropriate for the targeted resources.
Skills required
- LowAdversary can leverage privileged features they already have access to without additional effort or skill. Adversary is only required to have access to an account with improper priveleges.
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- Authorization
Execute Unauthorized Commands
Run Arbitrary Code
- Authorization
Gain Privileges
- Access ControlAuthorization
Bypass Protection Mechanism
Mitigations
- Configure account privileges such privileged/administrator functionality is not exposed to non-privileged/lower accounts.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ALAccount Locking1 shared
- D3-AAAgent Authentication1 shared
- D3-RUAARestore User Account Access1 shared
- D3-ULAUnlock Account1 shared
- D3-UAPUser Account Permissions1 shared
- D3-CDPChange Default Password1 shared
- D3-NTPMNetwork Traffic Policy Mapping1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-SFASystem File Analysis1 shared
- D3-SCPSystem Configuration Permissions1 shared
- D3-AMAccess Modeling1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.