Academy
TermAttack

Exploit kit

A web tool that scans a visitor’s browser and plugins and uses a vulnerability it finds to install malware without the user doing anything.

Flow

  1. 1Visitor arrives
  2. 2Versions read
  3. 3Vulnerability exploited
  4. 4Payload installed
Related families
Raccoon Stealer
MITRE ATT&CK
T1189 · Drive-by Compromise
Sources
7 sources
01

Overview

Exploit kits are placed on compromised pages or pages receiving traffic through ads. They read the visitor’s browser and plugin versions and, if there is a matching vulnerability, silently run code. MITRE ATT&CK

When a kit only uses known, already patched vulnerabilities, it has no effect on an up-to-date browser; its targets are unpatched systems. MITRE ATT&CK

02

How it works

  1. 1

    Visitor arrives

    A compromised site or a malicious ad sends the visitor to the kit. MITRE ATT&CK

  2. 2

    Versions read

    The browser, operating system and plugins are identified. MITRE ATT&CK

  3. 3

    Vulnerability exploited

    Code prepared for the matching vulnerability runs. MITRE ATT&CK

  4. 4

    Payload installed

    An infostealer or loader is downloaded and run. MITRE ATT&CK

03

Real-world examples

04

How to detect it

  • A browser process starting an unexpected child process. MITRE ATT&CK
05

What to do

06

MITRE ATT&CK

07

Related families and terms

08

Sources

  1. 1Drive-by Compromise (T1189) · MITRE ATT&CK
  2. 2Exploitation for Client Execution (T1203) · MITRE ATT&CK
  3. 3Gather Victim Host Information: Software (T1592.002) · MITRE ATT&CK
  4. 4Ingress Tool Transfer (T1105) · MITRE ATT&CK
  5. 5Raccoon Stealer — family entry and report index · Malpedia (Fraunhofer FKIE)
  6. 6Update Software (M1051) · MITRE ATT&CK
  7. 7Restrict Web-Based Content (M1021) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.