Content Injection (T1659) is a technique where an adversary gains access, or keeps talking to a victim, by injecting malicious content into traffic in transit. MITRE lists it under two tactics, Initial Access and Command and Control, and names Linux, macOS and Windows as platforms.
How attackers use it
Compare it with a drive-by attack. In a drive-by, the victim visits a compromised website that hosts a payload. With content injection, the adversary instead sits on the data-transfer channel and manipulates what the victim receives.
MITRE describes two positions:
- From the middle. The adversary is between a legitimate client and server. MITRE notes this is similar to Adversary-in-the-Middle (T1557) but distinct, because that technique covers activity inside an enterprise environment.
- From the side. Malicious content is injected and races to the client as a fake response to a request sent to a legitimate server.
The page adds that content injection often results from a compromised upstream channel, for example at the level of an internet service provider. The same channel can then deliver more payloads to a system that is already compromised.
MITRE's examples describe injected content in DNS, HTTP and SMB replies that sent targeted hosts to a fake update page to download malware.
How to detect it
MITRE's detection strategy for this technique focuses on what happens on the endpoint right after the injected content arrives:
- Windows: file creations and process executions triggered by browser activity, such as a payload written to the AppData or Temp directories and then run. Correlate network oddities with a local process or script starting soon after.
- Linux: commands such as curl or wget that save an executable or script to /tmp or /var/tmp and then execute it. Watch IDS or IPS alerts and packet captures for injected responses or mismatched content types.
- macOS: processes spawned from Safari or other browsers that load scripts or executables right away, and file drops in user cache or Downloads folders that run shortly after they are written.
How to reduce the risk
MITRE lists two mitigations.
- Encrypt Sensitive Information. Where possible, make sure online traffic is encrypted, for example through trusted VPNs. Injection is much harder against traffic the adversary cannot read or alter.
- Restrict Web-Based Content. Consider blocking the download, transfer and execution of uncommon file types that adversary campaigns are known to use.
Quick check
How does content injection differ from a drive-by compromise?
A drive-by relies on a compromised website that hosts the payload. Content injection manipulates the traffic between the victim and a legitimate server, so the victim can receive malicious content without visiting a compromised site.
Which endpoint pattern does MITRE suggest looking for?
A file written by browser or download activity, such as to a Temp or /tmp location, that is executed soon afterward, especially when it follows a network anomaly.
Sources
- MITRE ATT&CK, Content Injection (T1659): https://attack.mitre.org/techniques/T1659
