| name | T1659_content-injection |
| description | Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. |
| category | input-validation |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1659","initial-access","command-and-control","linux","macos","windows"] |
| technique_id | T1659 |
| tactic | initial-access |
| all_tactics | ["initial-access","command-and-control"] |
| platforms | ["Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1659 |
| tech_stack | ["linux","macos","windows"] |
| cwe_ids | ["CWE-20"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T1659 Content Injection
High-Level Description
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems.
Adversaries may inject content to victim systems in various ways, including:
- From the middle, where the adversary is in-between legitimate online client-server communications (Note: this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment)
- From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server
Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."
Kill Chain Phase
- Initial Access (TA0001)
- Command and Control (TA0011)
Platforms: Linux, macOS, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: MITM Proxy Injection
Start mitmdump and verify injected header and HTML content.
Supported Platforms: macos, linux
curl -skI --proxy http://127.0.0.1:8080 http://example.com > /tmp/curl_out.txt
grep /tmp/curl_out.txt || ( /tmp/curl_out.txt && 1)
curl -sk --proxy http://127.0.0.1:8080 http://example.com > /tmp/atomic_t1659_page.html
grep -q /tmp/atomic_t1659_page.html || ( -20 /tmp/atomic_t1659_page.html; 1)
