T1659
Content Injection
Linux · macOS · Windowsnothing on this site yetT1659 on attack.mitre.org
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Edge appliance or VPN compromise
A vendor advisory for a device you run at the perimeter, unexplained admin sessions on it, or an internal alert whose earliest source is the VPN range.
Web shell on a public-facing server
An unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.
how MITRE says to see it
Detection Strategy for Content Injection
- Detect suspicious file creations and process executions triggered by browser activity (e.g., injected payloads written to %AppData% or Temp directories, then executed). Correlate network anomalies with subsequent local process creation or script execution.
- Detect curl/wget commands saving executable/script payloads to /tmp or /var/tmp followed by execution. Monitor packet captures or IDS/IPS alerts for injected responses or mismatched content types.
- Monitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written.
what reduces it
- M1021 Restrict Web-Based Content. Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns.
- M1041 Encrypt Sensitive Information. Where possible, ensure that online traffic is appropriately encrypted through services such as trusted VPNs.