ATT&CK technique · T1202
Indirect Command Execution
Stealth· seen in 9 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-224 KEV CVEsImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Sequences like ../ in a file path escape the intended folder, exposing or overwriting other files.
- CWE-234 KEV CVEsRelative Path TraversalRelative ../ segments in input climb out of the allowed directory.
- CWE-364 KEV CVEsAbsolute Path TraversalAn absolute path in input points straight at a file outside the allowed directory.
- CWE-13211 KEV CVEImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Input changes the base prototype of JavaScript objects, altering behaviour across the whole application.
- CWE-2841 KEV CVEImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2851 KEV CVEImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-4341 KEV CVEUnrestricted Upload of File with Dangerous TypeUploads aren't restricted, so an attacker uploads a script (a web shell) and then requests it.
- CWE-5021 KEV CVEDeserialization of Untrusted DataUntrusted bytes are turned back into live objects, which can trigger code during reconstruction.
Controls that mitigate it (0)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
No NIST SP 800-53 mapping for this technique.
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.