CAPECattack pattern

CAPEC-636 Hiding Malicious Data or Code within Files

High Official page ↗

Abstraction: Standard
Status: Draft
Typical severity: High
CAPEC version: 3.9

Description

Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.

Prerequisites

• The operating system must support a file system that allows for alternate data storage for a file.

Mitigations

• Many tools are available to search for the hidden data. Scan regularly for such data using one of these tools.

Att&ck technique · MITRE ATT&CK (5)

T1027.004 Compile After Delivery sub-technique
T1001.002 Steganography sub-technique
T1027.003 Steganography sub-technique
T1218.001 Compiled HTML File sub-technique
T1221 Template Injection technique

Child of · CAPEC (1)

CAPEC-165 File Manipulation attack pattern

Weakness · CWE (1)

CWE-506 Embedded Malicious Code weakness

Referenced by CAPEC · child of (2)

CAPEC-168 Windows ::DATA Alternate Data Stream attack pattern
CAPEC-35 Leverage Executable Code in Non-Executable Files attack pattern

Referenced by CWE · attack pattern (1)

CWE-506 Embedded Malicious Code weakness