Standardlikelihood: Highseverity: HighDraft
CAPEC-653Use of Known Operating System Credentials
Abstraction
Standard
Status
Draft
Likelihood
High
Severity
High
Description
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.
Metadata: standard CAPEC pattern, status draft, likelihood high, severity high. Underlying weaknesses: CWE-522, CWE-307, CWE-308, CWE-309, CWE-262 (and 2 more). Related CAPEC patterns: [object Object], [object Object].
Related weaknesses· 7
Related attack patterns· 2
Exploits7
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Reliance on a Single Factor in a Security Decisioncwe-654 | 100% | live |
| Weakness | Not Using Password Agingcwe-262 | 100% | live |
| Weakness | Improper Restriction of Excessive Authentication Attemptscwe-307 | 100% | live |
| Weakness | Password Aging with Long Expirationcwe-263 | 100% | live |
| Weakness | Use of Password System for Primary Authenticationcwe-309 | 100% | live |
| Weakness | Insufficiently Protected Credentialscwe-522 | 100% | live |
| Weakness | Use of Single-factor Authenticationcwe-308 | 100% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.