aabisec/HAdata huggingface dataset:
T1157 — Dylib Hijacking Mitigation
Data sources: File monitoring
Prevent users from being able to write files to the search paths for applications, both in the folders where applications are run from and the standard dylib folders. If users can't write to these directories, then they can't intercept the search path.
T1069 — Permission Groups Discovery Mitigation
Data sources: API monitoring' ' Process command-line parameters;  Process monitoring
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about groups and permissions, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
T1034 — Path Interception Mitigation
Data sources: File monitoring;  Process monitoring
Eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them (Citation: Microsoft CreateProcess). Be aware of the search order Windows uses for executing or loading binaries and use fully qualified paths wherever appropriate (Citation: MSDN DLL Security). Clean up old Windows Registry keys when software is uninstalled to avoid keys with no associated legitimate binaries.

Periodically search for and correct or report path interception weaknesses on systems that may have been introduced using custom or available tools that report software using insecure path configurations (Citation: Kanthak Sentinel). 

Require that all executables be placed in write-protected directories. Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory <code>C:</code> and system directories, such as <code>C:\Windows\</code>, to reduce places where malicious files could be placed for execution.

Identify and block potentially malicious software that may be executed through the path interception by using whitelisting (Citation: Beechey 2010) tools, like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies, (Citation: Corio 2008) that are capable of auditing and/or blocking unknown executables.
T1152 — Launchctl Mitigation
Data sources: File monitoring' ' Process Monitoring;  Process command-line parameters
Prevent users from installing their own launch agents or launch daemons and instead require them to be pushed out by group policy.
M1015 — Active Directory Configuration
Data sources: , Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.
T1052 — Exfiltration Over Physical Medium Mitigation
Data sources: Data loss prevention;  File monitoring
Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)
M1051 — Update Software
Data sources: , Perform regular software updates to mitigate exploitation risk.
M1044 — Restrict Library Loading
Data sources: , Prevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software.
T1111 — Two-Factor Authentication Interception Mitigation
Data sources: nan
Remove smart cards when not in use. Protect devices and services used to transmit and receive out-of-band codes.

Identify and block potentially malicious software that may be used to intercept 2FA credentials on a system by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
T1492 — Stored Data Manipulation Mitigation
Data sources: , Identify critical business and system processes that may be targeted by adversaries and work to secure the data related to those processes against tampering. Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk. Consider encrypting important information to reduce an adversaries ability to perform tailor data modifications. Where applicable, examine using file monitoring software to check integrity on important files and directories as well as take corrective actions when unauthorized changes are detected. 

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and manipulate backups.
M1042 — Disable or Remove Feature or Program
Data sources: , Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.
T1118 — InstallUtil Mitigation
Data sources: Process monitoring;  Process command-line parameters
InstallUtil may not be necessary within a given environment. Use application whitelisting configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
T1054 — Indicator Blocking Mitigation
Data sources: Sensor health and status' ' Process command-line parameters;  Process monitoring
Ensure event tracers/forwarders (Citation: Microsoft ETW May 2018), firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls. Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.
T1112 — Modify Registry Mitigation
Data sources: Windows Registry' ' File monitoring' ' Process monitoring;  Process command-line parameters
Misconfiguration of permissions in the Registry may lead to opportunities for an adversary to execute code, like through [Service Registry Permissions Weakness](https://attack.mitre.org/techniques/T1058). Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

Identify and block unnecessary system utilities or potentially malicious software that may be used to modify the Registry by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
T1198 — SIP and Trust Provider Hijacking Mitigation
Data sources: API monitoring' ' Application Logs' ' DLL monitoring' ' Loaded DLLs;  Process Monitoring;  Windows Registry;  Windows event logs
Ensure proper permissions are set for Registry hives to prevent users from modifying keys related to SIP and trust provider components. Also ensure that these values contain their full path to prevent [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038). (Citation: SpectorOps Subverting Trust Sept 2017)

Consider removing unnecessary and/or stale SIPs. (Citation: SpectorOps Subverting Trust Sept 2017)

Restrict storage and execution of SIP DLLs to protected directories, such as C:\Windows, rather than user directories.

Enable whitelisting solutions such as AppLocker and/or Device Guard to block the loading of malicious SIP DLLs. Components may still be able to be hijacked to suitable functions already present on disk if malicious modifications to Registry keys are not prevented.
T1091 — Replication Through Removable Media Mitigation
Data sources: File monitoring;  Data loss prevention
Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if it is not required for business operations. (Citation: TechNet Removable Media Control)

Identify potentially malicious software that may be used to infect removable media or may result from tainted removable media, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
T1080 — Taint Shared Content Mitigation
Data sources: File monitoring;  Process monitoring
Protect shared folders by minimizing users who have write access. Use utilities that detect or mitigate common features used in exploitation, such as the Microsoft Enhanced Mitigation Experience Toolkit (EMET).

Reduce potential lateral movement risk by using web-based document management and collaboration services that do not use network file and directory sharing.

Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
T1145 — Private Keys Mitigation
Data sources: File monitoring
Use strong passphrases for private keys to make cracking difficult. When possible, store keys on separate cryptographic hardware instead of on the local system. Ensure only authorized keys are allowed access to critical resources and audit access lists regularly. Ensure permissions are properly set on folders containing sensitive private keys to prevent unintended access. Use separate infrastructure for managing critical systems to prevent overlap of credentials and permissions on systems that could be used as vectors for lateral movement. Follow other best practices for mitigating access through use of [Valid Accounts](https://attack.mitre.org/techniques/T1078).
T1053 — Scheduled Task Mitigation
Data sources: File monitoring' ' Process command-line parameters;  Process monitoring;  Windows event logs
Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges. (Citation: Powersploit)

Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl</code>. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled. (Citation: TechNet Server Operator Scheduled Task)

Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process. This can be can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority. (Citation: TechNet Scheduling Priority)

Identify and block unnecessary system utilities or potentially malicious software that may be used to schedule tasks using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
T1203 — Exploitation for Client Execution Mitigation
Data sources: Anti-virus;  System calls;  Process Monitoring
Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. (Citation: Windows Blogs Microsoft Edge Sandbox) (Citation: Ars Technica Pwn2Own 2017 VM Escape)

Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. The risks of additional exploits and weaknesses in implementation may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)

Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility.
T1094 — Custom Command and Control Protocol Mitigation
Data sources: Packet capture' ' Netflow/Enclave netflow' ' Process use of network;  Process monitoring
Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
T1057 — Process Discovery Mitigation
Data sources: Process command-line parameters;  Process monitoring
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
T1205 — Port Knocking Mitigation
Data sources: nan
Mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented.
T1108 — Redundant Access Mitigation
Data sources: [' Process monitoring' ' Process use of network' ' Packet capture'
 ' Network protocol analysis' ' File monitoring' ' Binary file metadata;  Authentication logs'], Identify and block potentially malicious software that may be used as a remote access tool, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and will be different across various malware families and versions. Adversaries will likely change tool signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
M1036 — Account Use Policies
Data sources: , Configure features related to account use like login attempt lockouts, specific login times, etc.
T1143 — Hidden Window Mitigation
Data sources: File monitoring
Whitelist programs that are allowed to have this plist tag. All other programs should be considered suspicious.
T1132 — Data Encoding Mitigation
Data sources: Packet capture' ' Process use of network' ' Process Monitoring;  Network protocol analysis
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
T1031 — Modify Existing Service Mitigation
Data sources: Windows Registry' ' File monitoring' ' Process command-line parameters;  Process monitoring
Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them. Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations. Toolkits like the PowerSploit framework contain the PowerUp modules that can be used to explore systems for Privilege Escalation weaknesses. (Citation: Powersploit)

Identify and block potentially malicious software that may be executed through service abuse by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown programs.
M1041 — Encrypt Sensitive Information
Data sources: , Protect sensitive information with strong encryption.
T1122 — Component Object Model Hijacking Mitigation
Data sources: Windows Registry;  DLL monitoring;  Loaded DLLs
Direct mitigation of this technique may not be recommended for a particular environment since COM objects are a legitimate part of the operating system and installed software. Blocking COM object changes may have unforeseen side effects to legitimate functionality.

Instead, identify and block potentially malicious software that may execute, or be executed by, this technique using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
###Human: What is Brute Force?###Assistant: It is about trying passwords again and again for a very long range of time until the password is guessed correctly. Captcha can be used to slow down the attack, also multifactor authentication can be used. Using complex passwords and lockout the account after a few attempts can be very useful as well.
###Human: What is Rainbow attack ?###Assistant: It is a type of brute force attack that uses pre-computed password hashes. It tries to match the hash in the user database. Salt techniques are used to prevent that. And same mitigation techniques as Brute force can be used as well.
###Human: What is Scanning?###Assistant: It is used to discover exploitable channels, open ports, and vulnerabilities. Firewall and IPS are the best defenders. OS hardening as well.
###Human: What is Phishing?###Assistant: It is tricking the user through disguised email. The actual intention is to bait the user to click an attachment or link. Educating users is the best mitigation along with Anti-spam. DMARC is a standard to verify the authenticity of the sender.
###Human: What is Whaling?###Assistant: It targets the senior leadership of an organization. Security awareness is the best mitigation in this case.
###Human: What is Exploit?###Assistant: Use to take advantage of a vulnerability. Along with the payload, it executes the malware. Exploits usually encrypt the files, delete the data, or stop certain services. Anti-Malware software or EndPoint detection & Response is the best mitigation technology in this case.
###Human: What is Spoofing?###Assistant: It is the method of impersonating the systems into what the scammers or hackers are not and gaining the trust wrongly. IP and MAC spoofing is used at a network level. and Email and DNS spoofing is also common. At the network level, we use ARP and MAC address spoofing and IPS is also a good security defender tool to mitigate this attack.
###Human: What is SYN Flood?###Assistant: The attacker sends a huge number of SYN requests in the TCP handshake process. This halts the server as the client never sends the acknowledgment keeps the server in wait hence exhausting the connections. Rate limiting, Anti-DDOS, and reducing connection wait time help achieve the required defense.
###Human: What is DNS poisoning?###Assistant: It diverts the traffic from legitimate DNS servers to fake ones. This is done through poising the data in the recursive DNS server. Auditing DNS zones are used to mitigate this attack.
###Human: What is Fileless Malware?###Assistant: It is injected into the memory as a process to perform malicious activities instead of generating malware through an executable. It doesn't have any trace on the disk.  EDR is the best defense for this type of attack as it doesn't rely on signature-based AV. Disabling Shell access and windows management instrumentation also helps significantly.
###Human: What is SQL Injection?###Assistant: It is the code injection in which malicious SQL queries are inserted into the legit database. Input validation, and WAF are helpful techniques to defend from SQL injection.
###Human: What is Cross Site scripting?###Assistant: Inserting scripts into the web server code. Usually done through a text box in on the website. Again input validation is the best method to mitigate it.
###Human: What is Ransomware?###Assistant: It encrypts the data and asks for a ransom. Backup, AV, and EDR are the tools used to avoid or defend against such attacks.
###Human: What is Remote Access Trojan?###Assistant: Type of malware that accesses the system remotely through a malicious code or executable. Avoid downloading suspicious attachments and keeping software up to date would help.
###Human: What is URL interpretation?###Assistant: In this case, an attacker modifies the URL to gain unauthorized access to the pages it should not have access to like Admin login pages. Secure authentication is used to prevent such attacks. Also keeping the internal pages to not exposed publicly will limit the damage.
###Human: What is Session Hijacking?###Assistant: The attacker performs a man-in-the-middle attack to take over the session between the client and server and starts impersonating either a client or a server. VPN is the best technique to prevent session hijacking as the data will be encrypted.
###Human: What is Insider Threat?###Assistant: This is generated usually from a trusted user or network. MFA and AAA are used to prevent such attacks.
###Human: What is R.U.D.Y Are you dead yet??###Assistant: A type of DDOS attack that aims to keep the web server tied up by submitting data at an absurdly slow pace. It breaks the packets into small bytes and sends them at randomized intervals. And it will keep sending the data indefinitely. Stricter connection time-out intervals are the best remedy in this case.
###Human: What is Slowloris?###Assistant: It opens several connections to the server usually HTTP. It then keeps these connections for as long as possible. Protecting the web servers through the reverse proxy to protect the origin server and rate limiting would certainly help.
###Human: What is NTP Amplification?###Assistant: It is a type of UDP flood or amplification where an attacker generates a lot of NTP traffic. It is a bit different from the flood attack. In amplification, the response usually generates a lot of traffic. It is like calling a restaurant and saying "I'll have one of everything, please call me to tell my whole order and call me back on the number" the number actually belongs to the victim. Monlist command can be disabled to prevent this and also distribute the traffic through anycast like how Cloudflare does.