Threat CC.AuC.CACHcLSS.1

URI: CC.AuC.CACHcLSS.1

Package: ProcessComms

< prev | next >

Description: Compromised client Client on host CHost used to access Service via LogicalSubnet: if Client is controlled by an attacker when its host CHost is on LogicalSubnet, the attacker can use Client to access Service via a privileged network path, thus acting as a false (impersonated) client.

Threat Type: Primary Threat

Matching Pattern:

MP-CACHcLSS

Finds a service accessed by a client via a subnet the client is on, and an associated context for access to the client, plus the two process hosts and optionally the client user and service manager.