DetailedCAPEC-581
CAPEC-581: Security Software Footprinting
Description
Adversaries may attempt to get a listing of security tools that are installed on the system and their configurations. This may include security related system features (such as a built-in firewall or anti-spyware) as well as third-party security software.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Collect and Analyze Information
Mitigations
- Identify programs that may be used to acquire security tool information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.