CAPEC-529: Malware-Directed Internal Reconnaissance
Description
Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.
- Likelihood of attack
- Medium
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The adversary must have internal, logical access to the target network and system.
Skills required
- MediumThe adversary must be able to obtain or develop, as well as place malicious software inside the target network/system.
Consequences
- Confidentiality
Read Data
Mitigations
- Keep patches up to date by installing weekly or daily if possible.
- Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.