An adversary gains access to an application, service, or device with the privileges of an authorized or privileged user by escaping the confines of a virtualized environment. The adversary is then able to access resources or execute unauthorized code within the host environment, generally with the privileges of the user running the virtualized process. Successfully executing an attack of this type is often the first step in executing more complex attacks.
Description
Attack Execution Flow
3
1
Step 1
Explore[Probing] The adversary probes the target application, service, or device to find a possible weakness that would allow escaping the virtualized environment.
Probing applications, services, or devices for virtualization weaknesses.
AI Translation
[Probing] L'avversario esamina l'applicazione, il servizio o il dispositivo target per individuare eventuali vulnerabilità che consentano di sfuggire all'ambiente virtualizzato.
Esaminare applicazioni, servizi o dispositivi alla ricerca di vulnerabilità nella virtualizzazione.
Attack Techniques
-
Probing applications, services, or devices for virtualization weaknesses.
2
Step 2
Experiment[Verify the exploitable security weaknesses] Using the found weakness, the adversary attempts to escape the virtualized environment.
Using an application weakness to escape a virtualized environment
AI Translation
[Verifica delle vulnerabilità di sicurezza sfruttabili] Utilizzando la vulnerabilità trovata, l'attore malevolo tenta di uscire dall'ambiente virtualizzato.
Utilizzo di una vulnerabilità di un'applicazione per uscire da un ambiente virtualizzato
Attack Techniques
-
Using an application weakness to escape a virtualized environment
3
Step 3
Exploit[Execute more complex attacks] Once outside of the virtualized environment, the adversary attempts to perform other more complex attacks such as accessing system resources or executing unauthorized code within the host environment.
Executing complex attacks when given higher permissions by escaping a virtualized environment
AI Translation
[Eseguire attacchi più complessi] Una volta al di fuori dell'ambiente virtualizzato, l'avversario tenta di eseguire altri attacchi più complessi, come accedere alle risorse di sistema o eseguire codice non autorizzato all’interno dell’ambiente host.
Eseguire attacchi complessi quando si ottengono permessi più elevati sfuggendo a un ambiente virtualizzato
Attack Techniques
-
Executing complex attacks when given higher permissions by escaping a virtualized environment
Mitigations
2
Abide By The Least Privilege Principle To Avoid Assigning Users More Privileges Than Necessary.
Ensure Virtualization Software Is Current And Up-To-Date.
Consequences
Security Scopes Affected
Access Control
Accountability
Authentication
Authorization
Non-Repudiation
Potential Impacts
Bypass Protection Mechanism
Execute Unauthorized Commands
Gain Privileges
Relationships
Parent CAPECs
Related ATT&CK Techniques
1
T1611
Escape to Host
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow …