CAPEC-313: Passive OS Fingerprinting
Description
An adversary engages in activity to detect the version or type of OS software in a an environment by passively monitoring communication between devices, nodes, or applications. Passive techniques for operating system detection send no actual probes to a target, but monitor network or client-server communication between nodes in order to identify operating systems based on observed behavior as compared to a database of known signatures or values. While passive OS fingerprinting is not usually as reliable as active methods, it is generally better able to evade detection.
- Likelihood of attack
- High
- Typical severity
- Low
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The ability to monitor network communications.Access to at least one host, and the privileges to interface with the network interface card.
Consequences
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Hide Activities
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.