Attack scenario
Malicious file upload and unsafe deserialization
An application accepts or processes a malicious file or serialized object and enables code execution, control bypass, or compromise of other users.
Why this scenario matters
The adversary abuses extension or Content-Type checks, polyglot files, parsers, archives, macros, images, documents, or gadget chains. Risk increases when content is stored in the web root, opened automatically, or processed with high privileges.
Controls include type allowlists, signature and structure validation, renaming, isolated storage, CDR or sandboxing, safe libraries, parser limits, least privilege, and avoidance of untrusted deserialization.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Command And Control
- Execution
- Initial Access
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.