Exploitation for defense evasion
Flaws exploited to escape sandboxes or suppress logging
categoryPhysical, insider and cross-cutting attacksseverityVery HighdetectabilityMediumlabnot yet measured
Classification
24 values: 6 reviewed, 12 imported, 6 derived. What do these mean?
Exploitability
| Attack vector | Software vulnerabilities |
|---|---|
| Attacker skill required | High |
| Resources required | Medium |
| Likelihood / prevalence | Low |
| Maturity | Established |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | IaaSLinuxmacOSSaaSWindows |
| Environment | CloudOn-premises |
| Target asset class | EndpointServer |
| Kill-chain phase (tactic) | Stealth |
Detection & telemetry
| Detectability | Medium |
|---|---|
| Data sources (ATT&CK data components) | Application Log ContentModule LoadProcess Creation |
| Defense bypassed | Anti-virusSystem access controls |
Detection & response
Mitigated by 10
- M1019 attack-mitigation
- M1048 attack-mitigation
- M1050 attack-mitigation
- M1051 attack-mitigation
D3-MBTd3fendD3-PCSVd3fendD3-PSEPd3fendD3-SAORd3fendD3-SFCVd3fendD3-SSCd3fend
Detected by 5
- DET0595 attack-detection-strategy
48d91a3a-2363-43ba-a456-ca71ac3da5c2sigma545a5da6-f103-4919-a519-e9aec1026ee4sigma6c82cf5c-090d-4d57-9188-533577631108sigmaae9b0bd7-8888-4606-b444-0ed7410cb728sigma
Framework references
- Primary source: https://attack.mitre.org/techniques/T1211/
- attack: T1211 (primary)
- cve: CVE-2024-20399
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 693 of Cyber-Attack-Taxonomy.md
- ev-0002 (CISA Known Exploited Vulnerabilities Catalog) — CISA KEV lists CVE-2024-20399 as known-exploited (kev=1, ransomware=unknown); added 2024-07-02.
Cisco NX-OS Command Injection Vulnerability
- ev-0003 (FIRST EPSS scores) — FIRST EPSS for CVE-2024-20399: epss=0.04306 percentile=0.90691 (score date 2026-09-18).
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0005 (NVD CVE API 2.0) — NVD maps CVE-2024-20399 to weakness(es) CWE-78.
- ev-0006 (NVD CVE API 2.0) — Example vulnerability CVE-2024-20399: NVD CVSS v3.1 base 6.7 (MEDIUM) [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H]. Not applied as facets: CVSS scores this one vulnerability, not the attack class.