tfMITRE ATT&CK sub-technique

Avoid CAPTCHA T1696.002

sub-technique of T1696 Anti-Automation Evasion

Tactic: Stealth
Platform: SaaS
Version: 1.0
Created: 21 September 2026
Last modified: 12 October 2026

Adversaries may avoid CAPTCHA challenges by mimicking human behavior. Automation tests, such as CAPTCHA, are typically used by defenders to detect and prevent bot and spam traffic from accessing protected webpages. CAPTCHAs are often placed before login screens or form fields. Traditional CAPTCHAs ask the user to decipher a string of characters, type the characters into a box, and submit the form. reCAPTCHA asks the user to identify images, click a checkbox, or evaluate the user’s behavior from mouse movement and device cookies.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 27% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 53% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 30% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1696.002

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Avoid CAPTCHA T1696.002

Avoid CAPTCHA T1696.002

Offense vs defense T1696.002

Avoid CAPTCHA mitigations T1696.002

Offense vs defense T1696.002

Avoid CAPTCHA mitigations T1696.002

Avoid CAPTCHA detections T1696.002

Avoid CAPTCHA detections T1696.002