CAPEC-17: Using Malicious Files
Description
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
- Likelihood of attack
- High
- Typical severity
- Very High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Subvert Access Control
Prerequisites
- System's configuration must allow an attacker to directly access executable files or upload files to execute. This means that any access control system that is supposed to mediate communications between the subject and the object is set incorrectly or assumes a benign environment.
Skills required
- LowTo identify and execute against an over-privileged system interface
Consequences
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
- Integrity
Modify Data
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Design: Enforce principle of least privilege
- Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.
- Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.
Related weaknesses (CWE)
- CWE-59Improper Link Resolution Before File Access ('Link Following')
- CWE-270Privilege Context Switching Error
- CWE-272Least Privilege Violation
- CWE-282Improper Ownership Management
- CWE-285Improper Authorization
- CWE-693Protection Mechanism Failure
- CWE-732Incorrect Permission Assignment for Critical Resource
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SICASystem Init Config Analysis1 shared
- D3-SBVService Binary Verification1 shared
- D3-SFASystem File Analysis1 shared
- D3-AVEAsset Vulnerability Enumeration1 shared
- D3-RSRestore Software1 shared
- D3-SWISoftware Inventory1 shared
- D3-SUSoftware Update1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-CIConfiguration Inventory1 shared
- D3-RCRestore Configuration1 shared
- D3-EALExecutable Allowlisting1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 01 shared
- CAR-2014-02-001Service Binary Modifications1 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared
- CAR-2013-01-002Autorun Differences1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared
Related attack patterns
Parent
More specific patterns
- CAPEC-177Create files with the same name as files protected with a higher classificationDetailed
- CAPEC-263Force Use of Corrupted FilesDetailed
- CAPEC-562Modify Shared FileDetailed
- CAPEC-563Add Malicious File to Shared WebrootDetailed
- CAPEC-642Replace BinariesDetailed
- CAPEC-650Upload a Web Shell to a Web ServerDetailed