T1696 · stealth · ATT&CK 20.0

Anti-Automation Evasion

Adversaries may employ various means to evade or complete automation checks. Automation checks distinguish human users from bot traffic and prevent bots from reaching the web pages protected by automation checks. For example, a user may be required to solve a CAPTCHA challenge before accessing a form or login page. Traditional CAPTCHAs ask the user to decipher a string of characters, type the characters into a box, and submit the form. reCAPTCHA asks the user to identify images, click a checkbox, or evaluate the user’s behavior from mouse movement and device cookies.(Citation: CAPTCHAS Cloudflare) Adversaries may pay for a service that forwards the CAPTCHA challenge to a remote human worker. The human service then solves the CAPTCHA on behalf of the bot.(Citation: CAPTCHA Bypass) AI tools, such as CapSolver, can also be used to automatically solve CAPTCHA challenges.(Citation: Capsolver)

Open in the interactive knowledge mesh

Detection overview

Use the published detection strategies below and validate required telemetry in the target environment.

Observed groups

No current Enterprise group relationship is published in this bundle.

Cyber Knowledge context

Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.

Controlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · Tactic learning route · 24/100Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · Tactic learning route · 24/100Disk, file-system, and persistence forensics
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100

MITRE mitigations

M1037 · Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges. Egress Traffic Filtering: - Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected. Protoc…

MITRE mitigation source
M1031 · Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

MITRE mitigation source

MITRE detection strategies and analytics