Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: Mandiant - Synful Knock)

Linked Issues

Issuelinks
Linktype Issue
is related to Techniques
is blocked by Detect Modification of Network Device Authentication via Patched System Images
is blocked by Privileged Account Management
is blocked by Multi-factor Authentication
is blocked by Access Restriction For Change
is blocked by Secure Baseline Configurations
is blocked by Continuous Monitoring
is blocked by Use of External Technology Assets, Applications and/or Services (TAAS)
is blocked by Endpoint File Integrity Monitoring (FIM)
is blocked by Separation of Duties (SoD)
is blocked by Identification & Authentication for Organizational Users
is blocked by Authenticator Management
is blocked by Account Management
is blocked by Access Enforcement
is blocked by Least Privilege
is blocked by Account Lockout
Impressum German English