T1554 Compromise Client Software Binary Mappings

Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server. Common client software types are SSH clients, FTP clients, email clients, and web browsers.

Adversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use. For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary (or support files) with the backdoored one. An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)(Citation: Unit42 Banking Trojans Hooking 2022) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.(Citation: ESET FontOnLake Analysis 2021)

Since these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
CA-08 Penetration Testing Protects T1554 Compromise Client Software Binary
CM-02 Baseline Configuration Protects T1554 Compromise Client Software Binary
CM-06 Configuration Settings Protects T1554 Compromise Client Software Binary
IA-09 Service Identification and Authentication Protects T1554 Compromise Client Software Binary
SI-07 Software, Firmware, and Information Integrity Protects T1554 Compromise Client Software Binary
SR-11 Component Authenticity Protects T1554 Compromise Client Software Binary
SR-04 Provenance Protects T1554 Compromise Client Software Binary
SR-05 Acquisition Strategies, Tools, and Methods Protects T1554 Compromise Client Software Binary
SR-06 Supplier Assessments and Reviews Protects T1554 Compromise Client Software Binary