{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1696.001","id":"T1696.001","name":"Automate CAPTCHA Completion","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1696/001","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"3914e106079a3f56772af7fedeedb9bb8c40a0b311084e4b9c887d109b289e94","description":"Adversaries may attempt to use bots to successfully solve CAPTCHA challenges. CAPTCHA challenges are typically used by defenders to detect and prevent bot and spam traffic from accessing protected webpages. CAPTCHAs are automated tests often placed before login screens or form fields. Traditional CAPTCHAs ask the user to decipher a string of characters, type the characters into a box, and submit the form. reCAPTCHA asks the user to identify images, click a checkbox, or evaluate the user’s behavior from mouse movement and device cookies.(Citation: CAPTCHAS Cloudflare) \n\nAdversaries may use scripts or toolkits to automatically solve the CAPTCHA puzzle. For example, adversaries may develop a script that uses the ImageMagick toolkit to solve the CAPTCHA puzzles to then create multiple valid accounts. ImageMagick tool can convert the images into a RGB complemented image. The CAPTCHA challenge may be solved by identifying and comparing attributes of the RGB images to select the expected image.(Citation: Free Trial PurpleUrchin) Once the CAPTCHA challenge is solved, the adversary’s script may access the protected page. After accessing the protected the page, the adversary may submit valid forms to the target. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1696/001","external_id":"T1696.001"},{"source_name":"CAPTCHAS Cloudflare","description":"Cloudflare. (n.d.). How CAPTCHAs work | What does CAPTCHA mean?. Retrieved September 16, 2026.","url":"https://www.cloudflare.com/learning/bots/how-captchas-work/"},{"source_name":"Free Trial PurpleUrchin","description":"Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.","url":"https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/"}],"platforms":["SaaS"],"environments":["cloud","saas"],"visibility":"source_mapping_gap","visibility_note":null,"parent":{"key":"enterprise/T1696","id":"T1696","name":"Anti-Automation Evasion","domain":"enterprise","level":"technique","parent_id":null,"tactics":["stealth"],"platforms":["SaaS"],"environments":["cloud","saas"],"page":"techniques/enterprise/T1696/","constraints":["isolated_authorized_lab","procedure_review_required","telemetry_configuration_required","disposable_tenant_and_cost_controls"],"telemetry_tags":["Telemetry mapping gap"],"telemetry_references":[],"detections":{"page":"detections/enterprise/T1696/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},"detection_status":"guidance_only","anomaly_tags":[],"tool_tags":[],"tool_references":[],"visibility":"source_mapping_gap","telemetry_status":"source_mapping_gap","classification":"cannot_simulate_yet","candidate_count":0,"implementation":"not_integrated","methods":[]},"children":[],"telemetry":[],"detection":{"key":"enterprise/T1696.001","id":"T1696.001","name":"Automate CAPTCHA Completion","domain":"enterprise","platforms":["SaaS"],"environments":["cloud","saas"],"source_url":"https://attack.mitre.org/techniques/T1696/001","technique_page":"techniques/enterprise/T1696.001/","page":"detections/enterprise/T1696.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0937","name":"Detection of Automated CAPTCHA","url":"https://attack.mitre.org/detectionstrategies/DET0937","stix_id":"x-mitre-detection-strategy--b91d85aa-d207-407e-b3dd-3adc4ed8fab0","relationship_id":"relationship--7a940875-43cb-47ae-8814-a5ae42e92749","description":"","analytics":[{"id":"AN2104","name":"Analytic 2104","guidance":"Successful CAPTCHA completion does not expose whether the challenge was solved manually, through automated tooling, through an AI-enabled solver, or through a third-party human-solving service. Providers may independently classify associated sessions as automated or bot-like, but this identifies suspicious automation rather than the method used to complete the CAPTCHA.","url":"https://attack.mitre.org/detectionstrategies/DET0937#AN2104","platforms":["SaaS"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[],"visibility":"source_mapping_gap","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Configure inline bot-management and web application protections to continue enforcing automation controls after a client successfully completes a CAPTCHA. Use challenge-token state as one input rather than as a durable trust determination, and prevent requests that subsequently exhibit automated or abusive behavior.","relationship_id":"relationship--e2ed7595-fbba-43d8-bee4-e44081ee870c","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Do not treat successful CAPTCHA completion alone as sufficient evidence that subsequent activity is human-generated. Continue evaluating requests using bot classification, request rate, client/session characteristics, token reuse, source reputation, and behavioral signals after successful challenge completion. Block or rate-limit activity that remains inconsistent with expected human use.","relationship_id":"relationship--f81a06a0-6561-4a64-a909-07def24113f8","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1696.001":"/ttp-simulation/techniques/enterprise/T1696.001/"},"synthetic":null}