CAPEC-655: Avoid Security Tool Identification by Adding Data
Description
An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions. In addition to this, adding data to a file also changes the file's hash, frustrating security tools that look for known bad files by their hash.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Consequences
- Accountability
Hide Activities; Bypass Protection Mechanism
- Integrity
Modify Data
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.
ATT&CK techniques (CAPEC taxonomy mapping)
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
- D3-FEVFile Eviction1 shared
- D3-FIMFile Integrity Monitoring1 shared
- D3-LFPLocal File Permissions1 shared