StandardCAPEC-545
CAPEC-545: Pull Data from System Resources
Description
An adversary who is authorized or has the ability to search known system resources, does so with the intention of gathering useful information. System resources include files, memory, and other aspects of the target system. In this pattern of attack, the adversary does not necessarily know what they are going to find when they start pulling data. This is different than CAPEC-150 where the adversary knows what they are looking for due to the common location.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Collect and Analyze Information
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
- CWE-1239Improper Zeroization of Hardware Register
- CWE-1243Sensitive Non-Volatile Information Not Protected During Debug
- CWE-1258Exposure of Sensitive System Information Due to Uncleared Debug Information
- CWE-1258Exposure of Sensitive System Information Due to Uncleared Debug Information
- CWE-1266Improper Scrubbing of Sensitive Data from Decommissioned Device
- CWE-1272Sensitive Information Uncleared Before Debug/Power State Transition
- CWE-1278Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
- CWE-1323Improper Management of Sensitive Trace Data
- CWE-1330Remanent Data Readable after Memory Erase
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared
- D3-FAFile Analysis2 shared
- D3-FEFile Encryption2 shared
- D3-FEVFile Eviction2 shared
- D3-FIMFile Integrity Monitoring2 shared
- D3-LFPLocal File Permissions2 shared
- D3-RFAMRemote File Access Mediation2 shared
- D3-RFRestore File2 shared
- D3-CQContent Quarantine2 shared
- D3-RDRestore Database1 shared