CAPEC-654: Credential Prompt Impersonation
Description
An adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- The adversary must already have access to the target system via some means.
- A legitimate task must exist that an adversary can impersonate to glean credentials.
Skills required
- LowOnce an adversary has gained access to the target system, impersonating a credential prompt is not difficult.
Consequences
- Access ControlAuthentication
Gain Privileges
Mitigations
- The only known mitigation to this attack is to avoid installing the malicious application on the device. However, to impersonate a running task the malicious application does need the GET_TASKS permission to be able to query the task list, and being suspicious of applications with that permission can help.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-IDAInput Device Analysis1 shared
- D3-ALAccount Locking1 shared
- D3-AAAgent Authentication1 shared
- D3-RUAARestore User Account Access1 shared
- D3-ULAUnlock Account1 shared
- D3-UAPUser Account Permissions1 shared
- D3-CDPChange Default Password1 shared
- D3-IOPRIO Port Restriction1 shared
- D3-MBTMemory Boundary Tracking1 shared
- D3-NTPMNetwork Traffic Policy Mapping1 shared
- D3-PCSVProcess Code Segment Verification1 shared
- D3-SBVService Binary Verification1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.