ATT&CK technique · T1189
Drive-by Compromise
Initial Access· seen in 21 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-4163 KEV CVEsUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-8433 KEV CVEsAccess of Resource Using Incompatible Type ('Type Confusion')An object is treated as the wrong type; a favourite in browser and JavaScript-engine exploits.
- CWE-1252 KEV CVEsOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-1902 KEV CVEsInteger Overflow or WraparoundA number grows past its maximum and wraps around, so a size check passes when it shouldn't.
- CWE-1912 KEV CVEsInteger Underflow (Wrap or Wraparound)A subtraction goes below zero and wraps to a huge value, typically leading to an oversized copy.
- CWE-7872 KEV CVEsOut-of-bounds WriteData is written outside the memory it belongs to; the most common root cause of exploited memory bugs.
- CWE-1191 KEV CVEImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1201 KEV CVEBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
Controls that mitigate it (18)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CA · Security Assessment and Authorization
CM · Configuration Management
SA · System and Services Acquisition
SC · System and Communications Protection
SI · System and Information Integrity
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.