CAPEC-616: Establish Rogue Location
Description
An adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and access the malicious resource.
- Likelihood of attack
- Medium
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- A resource is expected to available to the user.
Skills required
- LowAdversaries can often purchase low-cost technology to implement rogue access points.
Consequences
- ConfidentialityIntegrity
Other
Successful attacks of this nature can result in a wide variety of consequences and negatively impact confidentiality and integrity based on the adversary's subsequent actions.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SJAScheduled Job Analysis1 shared
- D3-SFASystem File Analysis1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-SCASystem Call Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-SCFSystem Call Filtering1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
Related attack patterns
Parent
More specific patterns
- CAPEC-505Scheme SquattingDetailed
- CAPEC-611BitSquattingDetailed
- CAPEC-615Evil Twin Wi-Fi AttackDetailed
- CAPEC-617Cellular Rogue Base StationDetailed
- CAPEC-630TypoSquattingDetailed
- CAPEC-631SoundSquattingDetailed
- CAPEC-632Homograph Attack via HomoglyphsDetailed
- CAPEC-667Bluetooth Impersonation AttackS (BIAS)Detailed
- CAPEC-695Repo JackingDetailed