CAPEC-504: Task Impersonation

MITRE CAPEC attack pattern

Description

An adversary, through a previously installed malicious application, impersonates an expected or routine task in an attempt to steal sensitive information or leverage a user's privileges.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-1021

ATT&CK techniques: T1036.004

Prerequisites

• The adversary must already have access to the target system via some means.
• A legitimate task must exist that an adversary can impersonate to glean credentials.
• The user's privileges allow them to execute certain tasks with elevated privileges.

Skills required

• Low: Once an adversary has gained access to the target system, impersonating a task is trivial.

Consequences

• Access Control, Authentication: Gain Privileges

Mitigations

• The only known mitigation to this attack is to avoid installing the malicious application on the device. However, to impersonate a running task the malicious application does need the GET_TASKS permission to be able to query the task list, and being suspicious of applications with that permission can help.

Source

• MITRE CAPEC CAPEC-504