Attack scenario
Injection and command execution
Untrusted input changes the meaning of a command, query, or template and enables data access, logic bypass, or code execution.
Why this scenario matters
The scenario includes SQL and NoSQL injection, OS command injection, LDAP and XPath injection, template injection, and related interpretation flaws. The adversary exploits missing parameterization, validation, escaping, or separation of data from commands.
Prevention starts with secure design and parameterized interfaces, continues through SAST, DAST, and testing, and is reinforced by runtime protection, WAF, least privilege, and anomalous-command detection.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Execution
- Initial Access
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.