Techniques › T1696
T1696 Anti-Automation Evasion
stealth — SaaS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1696
0
KEV CVEs mapped here
<p>Adversaries may employ various means to evade or complete automation checks. Automation checks distinguish human users from bot traffic and prevent bots from reaching the web pages protected by automation checks. For example, a user may be required to solve a CAPTCHA challenge before accessing a form or login page. Traditional CAPTCHAs ask the user to decipher a string of characters, type the characters into a box, and submit the form. reCAPTCHA asks the user to identify images, click a checkbox, or evaluate the user’s behavior from mouse movement and device cookies.</p><p>Adversaries may pay for a service that forwards the CAPTCHA challenge to a remote human worker. The human service then solves the CAPTCHA on behalf of the bot. AI tools, such as CapSolver, can also be used to automatically solve CAPTCHA challenges.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 75.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v20.0
- DET0939 Detection of Anti-Automation Evasion v1.0
AN2106 SaaSNo target-side behavioral Detection Strategy exists for CAPTCHA based solely on CAPTCHA telemetry.
Sigma rules · SigmaHQ c04ad420b4, tag attack.t1696
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.