Dark Mode
Capec-549 Detail
Local Execution of Code
Meta Software Likelihood: Medium Typical Severity: High
Children: 542
Threats: T79 T284 T287 T337 T389 T391 T403 T406
An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-549 | capec | https://capec.mitre.org/data/definitions/549.html | |
| CWE-829 | cwe | http://cwe.mitre.org/data/definitions/829.html |
Not present
- Knowledge of the target system's vulnerabilities that can be capitalized on with malicious code.The adversary must be able to place the malicious code on the target system.
- The means by which the adversary intends to place the malicious code on the system dictates the tools required. For example, suppose the adversary wishes to leverage social engineering and convince a legitimate user to open a malicious file attached to a seemingly legitimate email. In this case, the adversary might require a tool capable of wrapping malicious code into an innocuous filetype (e.g., PDF, .doc, etc.)
Not present
| Integrity | Availability | Confidentiality |
|---|---|---|
| Execute Unauthorized Commands (Run Arbitrary Code) | Execute Unauthorized Commands (Run Arbitrary Code) | Execute Unauthorized Commands (Run Arbitrary Code) |
| Other (Depending on the type of code executed by the adversary, the consequences of this attack pattern can vary widely.) | Other (Depending on the type of code executed by the adversary, the consequences of this attack pattern can vary widely.) | Other (Depending on the type of code executed by the adversary, the consequences of this attack pattern can vary widely.) |
- BlueBorne refers to a set of nine vulnerabilities on different platforms (Linux, Windows, Android, iOS) that offer an adversary the ability to install and execute malicious code on a system if they were close in proximity to a Bluetooth enabled device. One vulnerability affecting iOS versions 7 through 9 allowed an attacker to overflow the Low Energy Audio Protocol since commands sent over this protocol are improperly validated and gain the elevated permissions of the Bluetooth stack. These vulnerabilities were a result of poor validation and were patched shortly after their exposure in 2017, but many non-updated devices remain vulnerable.