Techniques › T1659
T1659 Content Injection
initial access · command and control — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1659
0
KEV CVEs mapped here
<p>Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems.</p><p>Adversaries may inject content to victim systems in various ways, including:</p>
- <li>From the middle, where the adversary is in-between legitimate online client-server communications (Note: this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment)</li><li>From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server</li>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0349 Detection Strategy for Content Injection v1.0
AN0992 WindowsDetect suspicious file creations and process executions triggered by browser activity (e.g., injected payloads written to %AppData% or Temp directories, then executed). Correlate network anomalies with subsequent local process creation or script execution.NSM:Flow
Unexpected script or binary content returned in HTTP response body→ DC0085 Network Traffic ContentTunable:MonitoredExtensionsSuspiciousParentProcessesRedirectListAN0993 LinuxDetect curl/wget commands saving executable/script payloads to /tmp or /var/tmp followed by execution. Monitor packet captures or IDS/IPS alerts for injected responses or mismatched content types.auditd:SYSCALLexecve: Execution of curl or wget writing files to /tmp/* followed by chmod or execution→ DC0064 Command ExecutionWinEventLog:SysmonFile creation of suspicious scripts/binaries in temporary directories→ DC0039 File CreationNSM:FlowInjected content responses with unexpected script/malware signatures→ DC0085 Network Traffic ContentTunable:TempDirectoriesAN0994 macOSMonitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written.macos:unifiedlogChild processes of Safari, Chrome, or Firefox executing scripting interpreters→ DC0032 Process Creationmacos:unifiedlogFile creation of unsigned binaries/scripts in user cache or download directories→ DC0039 File CreationNSM:FlowContent injection observed in HTTPS responses with mismatched certificates or altered payloads→ DC0085 Network Traffic ContentTunable:MonitoredDirectories
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1659
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.