SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Social engineering and human-targeted attacks

Pharming

DNS or host-file manipulation redirects victims to look-alike sites

categorySocial engineering and human-targeted attacksseverityVery HighdetectabilityHighlabnot yet measured

Classification

33 values: 12 reviewed, 14 imported, 7 derived. What do these mean?

Exploitability

Attack vector	Network attacksSocial engineering
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	None
User interaction	Active
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Established

Impact & scope

Severity	Very High
Impact	ConfidentialityIntegrity
Platform	LinuxmacOSNetwork DevicesWindows
Environment	CloudMobileOn-premises
Target asset class	HumanIdentityNetwork device
Kill-chain phase (tactic)	CollectionCredential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentFile ModificationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowWindows Registry Key Modification

Detection & response

Mitigated by 17

M1017 attack-mitigation
M1030 attack-mitigation
M1031 attack-mitigation
M1035 attack-mitigation
M1037 attack-mitigation
M1041 attack-mitigation
M1042 attack-mitigation
D3-APCA d3fend
D3-CAA d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RTSD d3fend
D3-UGLPA d3fend

Detected by 22

DET0296 attack-detection-strategy
0ed99dda-6a35-11ef-8c99-0242ac120002 sigma
16f5d8ca-44bd-47c8-acbe-6fc95a16c12f sigma
2074e137-1b73-4e2d-88ba-5a3407dbdce0 sigma
3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09 sigma
4096842a-8f9f-4d36-92b4-d0b2a62f9b2a sigma
4627c6ae-6899-46e2-aa0c-6ebcb1becd19 sigma
50e606bf-04ce-4ca7-9d54-3449494bbd4b sigma
5588576c-5898-4fac-bcdd-7475a60e8f43 sigma
5589ab4f-a767-433c-961d-c91f3f704db1 sigma
56fa3cd6-f8d6-4520-a8c7-607292971886 sigma
679085d5-f427-4484-9f58-1dc30a7c426d sigma
a557ffe6-ac54-43d2-ae69-158027082350 sigma
a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 sigma
b07e58cf-cacc-4135-8473-ccb2eba63dd2 sigma
bb0e87ce-c89f-4857-84fa-095e4483e9cb sigma
bc2e25ed-b92b-4daa-b074-b502bdd1982b sigma
c2c76b77-32be-4d1f-82c9-7e544bdfe0eb sigma
cd8c163e-a19b-402e-bdd5-419ff5859f12 sigma
d22df9cd-2aee-4089-93c7-9dc4eae77f2c sigma
e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c sigma
ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4 sigma

Tested by 1

deecd55f-afe0-4a62-9fba-4d1ba2deb321 atomic

Attack relationships

Child: ARP spoofing / poisoning
Child: DHCP starvation
Child: Evil twin AP
Child: LLMNR / NBT-NS / mDNS poisoning
Child: NTLM relay / name-resolution poisoning
Child: Rogue DHCP / DHCP spoofing
Child: SMB / NTLM relay

Framework references

Primary source: https://www.fortinet.com/resources/cyberglossary/types-of-phishing-attacks
attack: T1557 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 46 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 9 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)