MoustachedBouncerG1019 ↗
Has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.1
tfMITRE ATT&CK technique
Content Injection T1659
- Tactics
- Initial Access, Command and Control
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 01 September 2023
- Last modified
- 15 April 2025
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Content Injection MITRE reference T1659
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
DiscoS1088 ↗
Has achieved initial access and execution through content injection into DNS, HTTP, and SMB replies to targeted hosts that redirect them to download malicious files.1
All 1 software entries for this technique
Offense vs defense T1659
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Content Injection detection strategy DET0349
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Content Injection
3 platforms
AN0992 · Windows
Detect suspicious file creations and process executions triggered by browser activity (e.g., injected payloads written to %AppData% or Temp directories, then executed). Correlate network anomalies with subsequent local process creation or script execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Traffic ContentDC0085 | NSM:Flow | Unexpected script or binary content returned in HTTP response body |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredExtensions | File extensions to flag (exe, dll, js, vbs, sh, etc.). |
| SuspiciousParentProcesses | Browser processes (chrome.exe, firefox.exe, edge.exe, etc.) monitored as possible parents for malicious activity. |
| RedirectList | List of suspicious domains or URLs used for malicious redirects. |
AN0993 · Linux
Detect curl/wget commands saving executable/script payloads to /tmp or /var/tmp followed by execution. Monitor packet captures or IDS/IPS alerts for injected responses or mismatched content types.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | WinEventLog:Sysmon | File creation of suspicious scripts/binaries in temporary directories |
| Command ExecutionDC0064 | auditd:SYSCALL | execve: Execution of curl or wget writing files to /tmp/* followed by chmod or execution |
| Network Traffic ContentDC0085 | NSM:Flow | Injected content responses with unexpected script/malware signatures |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TempDirectories | Directories such as /tmp and /var/tmp where injected files are often written. |
AN0994 · macOS
Monitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Child processes of Safari, Chrome, or Firefox executing scripting interpreters |
| File CreationDC0039 | macos:unifiedlog | File creation of unsigned binaries/scripts in user cache or download directories |
| Network Traffic ContentDC0085 | NSM:Flow | Content injection observed in HTTPS responses with mismatched certificates or altered payloads |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredDirectories | macOS-specific directories where malicious payloads may be written. |
Where possible, ensure that online traffic is appropriately encrypted through services such as trusted VPNs.
Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns.
Tests2Executorsbash 1 · PowerShell 1Need elevation0 of 2Have prerequisites2Have cleanup2Platformsmacos, linux, windows
Tests from Atomic Red Team (MIT licence) · technique definition