CAPEC-636: Hiding Malicious Data or Code within Files
Description
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Manipulate System Resources
Prerequisites
- The operating system must support a file system that allows for alternate data storage for a file.
Mitigations
- Many tools are available to search for the hidden data. Scan regularly for such data using one of these tools.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
- T1001.002Data Obfuscation: Steganography
- T1027.003Obfuscated Files or Information: Steganography
- T1027.004Obfuscated Files or Information: Compile After Delivery
- T1218.001System Binary Proxy Execution: Compiled HTML File
- T1221Template Injection
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 4 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-DADynamic Analysis2 shared
- D3-EFAEmulated File Analysis2 shared
- D3-EALExecutable Allowlisting2 shared
- D3-EDLExecutable Denylisting2 shared
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared
- D3-FAFile Analysis2 shared
- D3-FEFile Encryption2 shared
- D3-FEVFile Eviction2 shared
- D3-FIMFile Integrity Monitoring2 shared
- D3-LFPLocal File Permissions2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.