StandardSeverity: Very HighCAPEC-30

CAPEC-30: Hijacking a Privileged Thread of Execution

Description

An adversary hijacks a privileged thread of execution by injecting malicious code into a running process. By using a privleged thread to do their bidding, adversaries can evade process-based detection that would stop an attack that creates a new process. This can lead to an adversary gaining access to the process's memory and can also enable elevated privileges. The most common way to perform this attack is by suspending an existing thread and manipulating its memory.

Likelihood of attack: Low
Typical severity: Very High
Abstraction: StandardA specific methodology or technique used in an attack.

Mechanism of attack: Subvert Access Control

Prerequisites

The application in question employs a threaded model of execution with the threads operating at, or having the ability to switch to, a higher privilege level than normal users
In order to feasibly execute this class of attacks, the adversary must have the ability to hijack a privileged thread. This ability includes, but is not limited to, modifying environment variables that affect the process the thread belongs to, or calling native OS calls that can suspend and alter process memory. This does not preclude network-based attacks, but makes them conceptually more difficult to identify and execute.

Skills required

HighHijacking a thread involves knowledge of how processes and threads function on the target platform, the design of the target application as well as the ability to identify the primitives to be used or manipulated to hijack the thread.

Consequences

ConfidentialityAccess ControlAuthorization
Gain Privileges
ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code

Mitigations

Application Architects must be careful to design callback, signal, and similar asynchronous constructs such that they shed excess privilege prior to handing control to user-written (thus untrusted) code.
Application Architects must be careful to design privileged code blocks such that upon return (successful, failed, or unpredicted) that privilege is shed prior to leaving the block/scope.

Related weaknesses (CWE)

CWE-270Privilege Context Switching Error

ATT&CK techniques (CAPEC taxonomy mapping)

T1055.003Process Injection: Thread Execution Hijacking

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

12 more in the full list

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

Related attack patterns

Parent

CAPEC-233Privilege EscalationMeta

Description

Prerequisites

The application in question employs a threaded model of execution with the threads operating at, or having the ability to switch to, a higher privilege level than normal users

In order to feasibly execute this class of attacks, the adversary must have the ability to hijack a privileged thread. This ability includes, but is not limited to, modifying environment variables that affect the process the thread belongs to, or calling native OS calls that can suspend and alter process memory. This does not preclude network-based attacks, but makes them conceptually more difficult to identify and execute.

Mitigations

Application Architects must be careful to design callback, signal, and similar asynchronous constructs such that they shed excess privilege prior to handing control to user-written (thus untrusted) code.

Application Architects must be careful to design privileged code blocks such that upon return (successful, failed, or unpredicted) that privilege is shed prior to leaving the block/scope.