CAPEC-639: Probe System Files
Description
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Medium
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- An adversary has access to the file system of a system.
Consequences
- Confidentiality
Read Data
Mitigations
- Verify that files have proper access controls set, and reduce the storage of sensitive information to only what is necessary.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-DNRDecoy Network Resource1 shared
- D3-NRAMNetwork Resource Access Mediation1 shared
- D3-NTPMNetwork Traffic Policy Mapping1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
- D3-CCSACredential Compromise Scope Analysis1 shared
- D3-CHCredential Hardening1 shared
- D3-CRCredential Revocation1 shared
- D3-CROCredential Rotation1 shared
- D3-CTSCredential Transmission Scoping1 shared
- D3-DUCDecoy User Credential1 shared
- D3-MFAMulti-factor Authentication1 shared
- D3-RICReissue Credential1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.