Cybersecurity glossary
What is an Attack Primitive?
Learn what an attack primitive is, how primitives compose into exploit chains and attack paths, examples across memory and identity, and how defenders detect reusable techniques.
Definition
An attack primitive is a reusable, relatively atomic adversary capability—such as an information leak, write-what-where, credential dump, or token theft—that can be combined with other primitives to construct reliable exploits, privilege escalations, or broader attack paths.
Why think in primitives
Complex intrusions look magical until you decompose them. An attack primitive is one reliable capability: leak an address, write a pointer, dump LSASS, mint a forged cookie. Attackers collect primitives; defenders should deny or detect them.
Mitigations often target primitives directly—ASLR fights predictable addresses; Credential Guard fights certain dump primitives.
How primitives compose
Obtain a first capability
A bug or misconfig yields a leak, crash, write, or auth bypass fragment.
Stabilize and repeat
Turn a flaky effect into a reliable primitive under real conditions.
Combine with companion primitives
Pair leak + write, or token theft + lateral auth, to bypass defenses.
Reach a higher-level objective
Code execution, domain privilege, or data access emerges from the stack.
Reuse across campaigns
The same primitive patterns reappear in new malware and red tools.
Example primitive classes
Memory primitives
Arbitrary read, arbitrary write, controlled free, type confusion gadgets.
Identity primitives
Session cookie theft, ticket extraction, API key disclosure.
Execution primitives
Command injection sink, unsigned script run, living-off-the-land binaries.
Network primitives
SSRF to metadata, forced outbound callback, SMB relay positioning.
Defending at the primitive layer
| Primitive | Defensive idea |
|---|---|
| Info leak (memory) | Memory safety, sandboxing, reduced debugger exposure |
| Credential material access | Credential Guard, least privilege, secret isolation |
| Arbitrary file write | Integrity controls, allowlisted write paths, protected configs |
| Token / cookie theft | Sender-constrained tokens, short TTL, device binding |
| Unsigned code run | Application control, WDAC/AppLocker policies |
- In exploit reports, name the primitives achieved—not only the final headline impact.
- Map EDR detections to primitives attackers need for common ransomware paths.
- Prioritize mitigations that invalidate entire primitive classes.
- Use purple teaming to test one primitive’s visibility before full path sims.
- Track recurring primitives across pentest findings as systemic debt.
- Assume public research advances make yesterday’s “hard” primitives easier.
- Separate “bug exists” from “primitive is reliably obtainable remotely.”
- Design apps so dangerous sinks cannot become execution primitives.
The practical takeaway
An attack primitive is a building-block capability. Break or detect the blocks, and full exploits become much harder to assemble.
If you only patch final “RCE” labels without understanding the primitives, the next chain will reuse the same pieces.
Related security terms
Attack Path
Longer routes assembled from multiple primitives and environmental edges.
Exploit Chain
Ordered combination of primitives and vulns toward a concrete impact.
Exploitability
How readily primitives can be achieved reliably on a target.
Buffer Overflow
Classic bug class that often yields memory corruption primitives.
Purple Team
Often validates detections for one primitive or technique at a time.
Frequently asked questions
What is an attack primitive in simple terms?
It is a small, reusable attacker skill or bug effect—like “read secret memory” or “steal a login token”—that gets stacked into bigger attacks.
How is a primitive different from a full exploit?
An exploit is the packaged procedure. Primitives are the component powers the exploit needs to succeed.
Why do memory-safety talks mention primitives?
Modern exploits often need an info leak plus a controlled write (or similar) because single bugs rarely defeat all mitigations alone.
Are ATT&CK techniques primitives?
Related but not identical. ATT&CK techniques are behavioral categories; primitives are often more atomic technical capabilities used inside those behaviors.
Can identity attacks have primitives?
Yes—examples include refresh-token theft, Kerberos ticket extraction, or abusive OAuth consent as building blocks.
How should defenders use the concept?
Detect and prevent high-value primitives early so attackers cannot assemble complete chains.
Is a CVE an attack primitive?
No. A CVE identifies a vulnerability instance. That instance may enable one or more primitives when exploited.
References
Explore authoritative guidance and frameworks related to attack primitive.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.