|
|
|
CAPEC-636: Hiding Malicious Data or Code within Files |
Description Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover. Typical Severity Prerequisites
The operating system must support a file system that allows for alternate data storage for a file. |
Mitigations
Many tools are available to search for the hidden data. Scan regularly for such data using one of these tools. |
Taxonomy Mappings CAPEC mappings to ATT&CK techniques leverage an inheritance model to streamline and minimize direct CAPEC/ATT&CK mappings. Inheritance of a mapping is indicated by text stating that the parent CAPEC has relevant ATT&CK mappings. Note that the ATT&CK Enterprise Framework does not use an inheritance model as part of the mapping to CAPEC.Relevant to the ATT&CK taxonomy mapping (also see parent) Entry ID | Entry Name |
---|
1001.002 | Data Obfuscation: Steganography | 1027.003 | Obfuscated Files or Information: Steganography | 1027.004 | Obfuscated Files or Information: Compile After Delivery | 1218.001 | Signed Binary Proxy Execution: Compiled HTML File | 1221 | Template Injection |
References Content History Submissions |
---|
Submission Date | Submitter | Organization |
---|
2018-05-31 (Version 2.11) | CAPEC Content Team | The MITRE Corporation | | Modifications |
---|
Modification Date | Modifier | Organization |
---|
2019-04-04 (Version 3.1) | CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | 2020-07-30 (Version 3.3) | CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | 2021-06-24 (Version 3.5) | CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | 2022-09-29 (Version 3.8) | CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | 2023-01-24 (Version 3.9) | CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
More information is available — Please select a different filter.
|