Sınıf: Exploit
Exploits, açık veya kötü niyetli amaçlarla yerel veya uzak bilgisayarda çalışan yazılımlardaki bir veya daha fazla güvenlik açığından yararlanan veri veya yürütülebilir kod içeren programlardır. Çoğu zaman, kötü niyetli kullanıcılar, daha sonra kötü amaçlı kod yüklemek için (örneğin, tüm ziyaretçileri kötü niyetli bir programla tehlikeye girmiş bir web sitesine bulaştıracak şekilde) bir kurbanın bilgisayarına girmek için bir istismar kullanırlar. Ayrıca, kullanıcılardan herhangi bir işlem yapılmaksızın bir kurbanın bilgisayarını kesmek için, Net-Worms tarafından istismarlar yaygın olarak kullanılmaktadır. Nuker programları istismarlar arasında dikkate değerdir; Bu tür programlar, yerel veya uzak bilgisayarlara özel hazırlanmış istekleri göndererek sistemin çökmesine neden olur.Platform: Win32
Win32, 32-bit uygulamaların yürütülmesini destekleyen Windows NT tabanlı işletim sistemlerinde (Windows XP, Windows 7, vb.) Bir API'dir. Dünyanın en yaygın programlama platformlarından biri.Aile: Exploit.Win32.UAC
No family descriptionExamples
562CEDB63669FF8DE396961EDBF72EA9Tactics and Techniques: Mitre*
TA0004
Privilege Escalation
The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
T1134.004
Parent PID Spoofing
Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the
CreateProcess API call, which supports a parameter that defines the PPID to use. This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context. TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1134.004
Parent PID Spoofing
Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the
CreateProcess API call, which supports a parameter that defines the PPID to use. This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context. * © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.