Standard attack pattern
Draft
CAPEC-30: Hijacking a Privileged Thread of Execution
An adversary hijacks a privileged thread of execution by injecting malicious code into a running process. By using a privleged thread to do their bidding, adversaries can evade process-based detection that would stop an attack that creates a new process. This can lead to an adversary gaining access to the process's memory and can also enable elevated privileges. The most common way to perform this attack is by suspending an existing thread and manipulating its memory.
Very High
Typical severity
Per MITRE
Low
Likelihood of attack
Per MITRE
1
Related weaknesses
CWEs this targets
Standard
Abstraction
MITRE classification
Overview
CAPEC-30 (Hijacking a Privileged Thread of Execution) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.