A CAPTCHA asks a visitor to prove they are human before a login page or form loads. MITRE ATT&CK T1696, Anti-Automation Evasion, covers adversaries who evade or complete those checks so a bot can reach the protected page. It belongs to the Stealth tactic and the platform listed is SaaS.
How attackers use it
MITRE describes two broad routes, which have their own sub-techniques. One is solving the challenge: paying a service that forwards the CAPTCHA to a remote human worker, or using AI tools built to solve CAPTCHAs automatically. That is covered by Automate CAPTCHA Completion (T1696.001). The other is avoiding the challenge by acting like a person, which is Avoid CAPTCHA (T1696.002).
How to detect it
MITRE is frank here. Its detection entry says there is no target-side behavioral detection strategy for this technique based on CAPTCHA telemetry alone. A solved CAPTCHA looks the same whoever solved it. So detection has to come from the traffic around the challenge: request rate, session and client characteristics, token reuse, source reputation and behavior after the page loads.
How to reduce the risk
The two mitigations on the page point the same direction:
- Use a web application firewall, bot management and application-layer filtering to restrict automated access. Judge requests by characteristics, session reputation, behavior, rate limits and validated client or bot identity, then block, rate-limit or challenge violations.
- Use inline protections that spot automation before requests reach sensitive functions, and rely on several signals rather than successful CAPTCHA completion alone.
Quick check
If a visitor passed the CAPTCHA, can you treat the session as human?
No. A passed challenge says only that something solved it. Keep scoring the session on rate, behavior and client signals afterward.
