CAPEC-504: Task Impersonation
Description
An adversary, through a previously installed malicious application, impersonates an expected or routine task in an attempt to steal sensitive information or leverage a user's privileges.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- The adversary must already have access to the target system via some means.
- A legitimate task must exist that an adversary can impersonate to glean credentials.
- The user's privileges allow them to execute certain tasks with elevated privileges.
Skills required
- LowOnce an adversary has gained access to the target system, impersonating a task is trivial.
Consequences
- Access ControlAuthentication
Gain Privileges
Mitigations
- The only known mitigation to this attack is to avoid installing the malicious application on the device. However, to impersonate a running task the malicious application does need the GET_TASKS permission to be able to query the task list, and being suspicious of applications with that permission can help.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SJAScheduled Job Analysis1 shared
- D3-SFASystem File Analysis1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-SCASystem Call Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-SCFSystem Call Filtering1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.