| 名称 |
Malware-Directed Internal Reconnaissance |
|
| 攻击可能性 |
典型严重性 |
| Medium |
Medium |
|
| 摘要 |
Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network. |
| 前置条件 |
The adversary must have internal, logical access to the target network and system. |
| 解决方案 | Keep patches up to date by installing weekly or daily if possible. Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist. |
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-169 |
An adversary engages in probing and exploration activities to identify constituents and properties of the target. |
|