CAPECattack pattern

CAPEC-639 Probe System Files

Medium Official page ↗
Abstraction
Detailed
Status
Stable
Typical severity
Medium
CAPEC version
3.9

Description

An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.

Prerequisites

• An adversary has access to the file system of a system.

Consequences

• Confidentiality: Read Data

Mitigations

• Verify that files have proper access controls set, and reduce the storage of sensitive information to only what is necessary.

Related

Att&ck technique · MITRE ATT&CK (5)

  • T1552.006 Group Policy Preferences sub-technique
  • T1552.001 Credentials In Files sub-technique
  • T1552.003 Shell History sub-technique
  • T1552.004 Private Keys sub-technique
  • T1039 Data from Network Shared Drive technique

Child of · CAPEC (1)

  • CAPEC-545 Pull Data from System Resources attack pattern

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

Referenced by CWE · attack pattern (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness