CAPEC-573: Process Footprinting
An adversary exploits functionality meant to identify information about the currently running processes on the target system to an authorized user. By knowing what processes are running on the target system, the adversary can learn about the target environment as a means towards further malicious behavior.
Last updated
Overview
CAPEC-573 (Process Footprinting) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
What the attacker needs
Prerequisites
- The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.
Consequences
What a successful CAPEC-573 attack can achieve.
Other
Affects: Confidentiality
Bypass Protection Mechanism, Hide Activities
Affects: Confidentiality, Access Control, Authorization
How to mitigate it
Defenses that reduce the risk of CAPEC-573.
- Identify programs that may be used to acquire process information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
Examples
On a Windows system, the command, "tasklist," displays information about processes. The same function on a Mac OS system is done with the command, "ps."
In addition to manual discovery of running processes, an adversary can develop malware that carries out this attack pattern before subsequent malicious action.