CAPEC-558: Replace Trusted Executable
Description
An adversary exploits weaknesses in privilege management or access control to replace a trusted executable with a malicious version and enable the execution of malware when that trusted executable is called.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ABPIApplication-based Process Isolation2 shared
- D3-HRHost Reboot2 shared
- D3-HSHost Shutdown2 shared
- D3-KBPIKernel-based Process Isolation2 shared
- D3-PLAProcess Lineage Analysis2 shared
- D3-PSMDProcess Self-Modification Detection2 shared
- D3-PSProcess Suspension2 shared
- D3-PTProcess Termination2 shared
- D3-AVEAsset Vulnerability Enumeration2 shared
- D3-RSRestore Software2 shared
- D3-SWISoftware Inventory2 shared
- D3-SUSoftware Update2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2020-09-002Component Object Model Hijacking1 shared
- CAR-2020-09-005AppInit DLLs1 shared
- CAR-2020-11-011Registry Edit from Screensaver1 shared
- CAR-2021-02-001Webshell-Indicative Process Tree1 shared
- CAR-2013-01-002Autorun Differences1 shared