ATT&CK technique · T1496
Resource Hijacking
Impact· seen in 19 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-774 KEV CVEsImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-784 KEV CVEsImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-13212 KEV CVEsImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Input changes the base prototype of JavaScript objects, altering behaviour across the whole application.
- CWE-222 KEV CVEsImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Sequences like ../ in a file path escape the intended folder, exposing or overwriting other files.
- CWE-232 KEV CVEsRelative Path TraversalRelative ../ segments in input climb out of the allowed directory.
- CWE-362 KEV CVEsAbsolute Path TraversalAn absolute path in input points straight at a file outside the allowed directory.
- CWE-742 KEV CVEsImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The general injection flaw: data crosses into a component that interprets part of it as instructions.
- CWE-2871 KEV CVEImproper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
Controls that mitigate it (0)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
No NIST SP 800-53 mapping for this technique.
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.