{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1696","id":"T1696","name":"Anti-Automation Evasion","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1696","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"fa30b3ae96c11229a04e4fe32c12b5d400b66c98792006bcb4d1b100b7c66605","description":"Adversaries may employ various means to evade or complete automation checks. Automation checks distinguish human users from bot traffic and prevent bots from reaching the web pages protected by automation checks. For example, a user may be required to solve a CAPTCHA challenge before accessing a form or login page. Traditional CAPTCHAs ask the user to decipher a string of characters, type the characters into a box, and submit the form. reCAPTCHA asks the user to identify images, click a checkbox, or evaluate the user’s behavior from mouse movement and device cookies.(Citation: CAPTCHAS Cloudflare) \n\nAdversaries may pay for a service that forwards the CAPTCHA challenge to a remote human worker. The human service then solves the CAPTCHA on behalf of the bot.(Citation: CAPTCHA Bypass) AI tools, such as CapSolver, can also be used to automatically solve CAPTCHA challenges.(Citation: Capsolver) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1696","external_id":"T1696"},{"source_name":"CAPTCHAS Cloudflare","description":"Cloudflare. (n.d.). How CAPTCHAs work | What does CAPTCHA mean?. Retrieved September 16, 2026.","url":"https://www.cloudflare.com/learning/bots/how-captchas-work/"},{"source_name":"Capsolver","description":"Ethan Collins. (2026, May 21). How Agentic Browsers Solve CAPTCHAs: AI CAPTCHA Solving Infrastructure. Retrieved September 16, 2026.","url":"https://www.capsolver.com/blog/ai/agentic-browser-capsolver"},{"source_name":"CAPTCHA Bypass","description":"Suchintan Singh. (2025, September 8). Best Way to Bypass CAPTCHA for AI Browser Automation (August 2026). Retrieved September 16, 2026.","url":"https://www.skyvern.com/blog/best-way-to-bypass-captcha-for-ai-browser-automation-september-2025/"}],"platforms":["SaaS"],"environments":["cloud","saas"],"visibility":"source_mapping_gap","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1696.001","id":"T1696.001","name":"Automate CAPTCHA Completion","page":"techniques/enterprise/T1696.001/"},{"key":"enterprise/T1696.002","id":"T1696.002","name":"Avoid CAPTCHA","page":"techniques/enterprise/T1696.002/"}],"telemetry":[],"detection":{"key":"enterprise/T1696","id":"T1696","name":"Anti-Automation Evasion","domain":"enterprise","platforms":["SaaS"],"environments":["cloud","saas"],"source_url":"https://attack.mitre.org/techniques/T1696","technique_page":"techniques/enterprise/T1696/","page":"detections/enterprise/T1696/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0939","name":"Detection of Anti-Automation Evasion","url":"https://attack.mitre.org/detectionstrategies/DET0939","stix_id":"x-mitre-detection-strategy--832681d0-1369-4915-a7b4-6627d7205a67","relationship_id":"relationship--cc94fde7-0ff1-4f63-991a-f52320316ef2","description":"","analytics":[{"id":"AN2106","name":"Analytic 2106","guidance":"No target-side behavioral Detection Strategy exists for CAPTCHA based solely on CAPTCHA telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0939#AN2106","platforms":["SaaS"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[],"visibility":"source_mapping_gap","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Deploy inline application-layer protections capable of identifying and preventing automated activity before requests reach protected application functionality. Use multiple automation signals rather than relying exclusively on successful CAPTCHA completion.","relationship_id":"relationship--0b38630d-1363-4817-9788-e5848e1f0f36","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Use web application firewalls, bot-management controls, and application-layer traffic filtering to restrict automated access to protected resources. Apply filtering using request characteristics, client/session reputation, behavioral signals, rate limits, and validated client or bot identity. Block, rate-limit, or challenge traffic that violates established access policies.","relationship_id":"relationship--04f6d882-3964-4d57-bc83-714b7cb4264d","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1696":"/ttp-simulation/techniques/enterprise/T1696/"},"synthetic":null}