CAPEC-191: Read Sensitive Constants Within an Executable
Description
An adversary engages in activities to discover any sensitive constants present within the compiled code of an executable. These constants may include literal ASCII strings within the file itself, or possibly strings hard-coded into particular routines that can be revealed by code refactoring methods including static and dynamic analysis.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Low
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- Access to a binary or executable such that it can be analyzed by various utilities.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-NTPMNetwork Traffic Policy Mapping1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
- D3-CCSACredential Compromise Scope Analysis1 shared
- D3-CHCredential Hardening1 shared
- D3-CRCredential Revocation1 shared
- D3-CROCredential Rotation1 shared
- D3-CTSCredential Transmission Scoping1 shared
- D3-DUCDecoy User Credential1 shared
- D3-MFAMulti-factor Authentication1 shared
- D3-RICReissue Credential1 shared
- D3-SCPSystem Configuration Permissions1 shared
- D3-AMAccess Modeling1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.