auren-research/cyber-sec huggingface dataset:
An adversary registers a domain name with at least one character different than a trusted domain. A TypoSquatting attack takes advantage of instances where a user mistypes a URL (e.g. www.goggle.com) or not does visually verify a URL before clicking on it (e.g. phishing attack). As a result, the user is directed to an adversary-controlled destination. TypoSquatting does not require an attack against the trusted domain or complicated reverse engineering.
Low
Medium

1
Explore
[Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic.
Research popular or high traffic websites.

2
Experiment
[Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the TypoSquatted URL.
Register the TypoSquatted domain.

3
Exploit
[Deceive user into visiting domain] Finally, the adversary needs to deceive a user into visiting the TypoSquatted domain.
Execute a phishing attack and send a user an e-mail convincing the user to click on a link leading the user to the TypoSquatted domain.
Assume that a user will incorrectly type the legitimate URL, leading the user to the TypoSquatted domain.

An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.

Adversaries must be able to register DNS hostnames/URL’s.

Other
Other
Depending on the intention of the adversary, a successful TypoSquatting attack can be leveraged to execute more complex attacks such as cross-site scripting or stealing account credentials.

Authenticate all servers and perform redundant checks when using DNS hostnames.
Purchase potential TypoSquatted domains and forward to legitimate domain.

An adversary sends an email, impersonating paypal.com, to a user stating that they have just received a money transfer and to click the given link to obtain their money.
However, the link the in email is paypa1.com instead of paypal.com, which the user clicks without fully reading the link.
The user is directed to the adversary's website, which appears as if it is the legitimate paypal.com login page.
The user thinks they are logging into their account, but have actually just given their paypal credentials to the adversary. The adversary can now use the user's legitimate paypal credentials to log into the user's account and steal any money which may be in the account.
TypoSquatting vulnerability allows an adversary to impersonate a trusted domain and trick a user into visiting the malicious website to steal user credentials.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Phases

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns
An adversary registers a domain name that sounds the same as a trusted domain, but has a different spelling. A SoundSquatting attack takes advantage of a user's confusion of the two words to direct Internet traffic to adversary-controlled destinations. SoundSquatting does not require an attack against the trusted domain or complicated reverse engineering.

Homophone Attack

Low
Medium

1
Explore
[Determine target website] The adversary first determines which website to impersonate, generally one that is trusted, receives a consistent amount of traffic, and is a homophone.
Research popular or high traffic websites which are also homophones.

2
Experiment
[Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the SoundSquatted URL.
Register the SoundSquatted domain.

3
Exploit
[Deceive user into visiting domain] Finally, the adversary needs to deceive a user into visiting the SoundSquatted domain.
Execute a phishing attack and send a user an e-mail convincing the user to click on a link leading the user to the SoundSquatted domain.
Assume that a user will unintentionally use the homophone in the URL, leading the user to the SoundSquatted domain.

An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.

Adversaries must be able to register DNS hostnames/URL’s.

Other
Other
Depending on the intention of the adversary, a successful SoundSquatting attack can be leveraged to execute more complex attacks such as cross-site scripting or stealing account credentials.

Authenticate all servers and perform redundant checks when using DNS hostnames.
Purchase potential SoundSquatted domains and forward to legitimate domain.

An adversary sends an email, impersonating the popular banking website guaranteebanking.com, to a user stating that they have just received a new deposit and to click the given link to confirm the deposit.
However, the link the in email is guarantybanking.com instead of guaranteebanking.com, which the user clicks without fully reading the link.
The user is directed to the adversary's website, which appears as if it is the legitimate guaranteebanking.com login page.
The user thinks they are logging into their account, but have actually just given their guaranteebanking.com credentials to the adversary. The adversary can now use the user's legitimate guaranteebanking.com credentials to log into the user's account and steal any money which may be in the account.See also: SoundSquatting vulnerability allows an adversary to impersonate a trusted domain and leverages a user's confusion between the meaning of two words which are pronounced the same into visiting the malicious website to steal user credentials.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Phases

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
Medium

This pattern of attack is only applicable when a downstream user leverages tokens to verify identity, and then takes action based on that identity.

Integrity
Alter Execution Logic
By faking the source of data or services, an adversary can cause a target to make incorrect decisions about how to proceed.

Integrity
Gain Privileges
By impersonating identities that have an increased level of access, an adversary gain privilege that they many not have otherwise had.

Integrity
Hide Activities
Faking the source of data or services can be used to create a false trail in logs as the target will associated any actions with the impersonated identity instead of the adversary.

1134
Access Token Manipulation

CAPEC Content Team
The MITRE Corporation
2018-04-12

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses, Taxonomy_Mappings
The adversary exploits the target system's audio and video functionalities through malware or scheduled tasks. The goal is to capture sensitive information about the target for financial, personal, political, or other gains which is accomplished by collecting communication data between two parties via the use of peripheral devices (e.g. microphones and webcams) or applications with audio and video capabilities (e.g. Skype) on a system.
Low
High

Knowledge of the target device's or application’s vulnerabilities that can be capitalized on with malicious code. The adversary must be able to place the malicious code on the target device.

To deploy a hidden process or malware on the system to automatically collect audio and video data.

Confidentiality
Read Data

Prevent unknown code from executing on a system through the use of an allowlist policy.
Patch installed applications as soon as new updates become available.

An adversary can capture audio and video, and transmit the recordings to a C2 server or a similar capability.
An adversary can capture and record from audio peripherals in a vehicle via a Car Whisperer attack. If an adversary is within close proximity to a vehicle with Bluetooth capabilities, they may attempt to connect to the hands-free system when it is in pairing mode. With successful authentication, if an authentication system is present at all, an adversary may be able to play music/voice recordings, as well begin a recording and capture conversations happening inside the vehicle. Successful authentication relies on the pairing security key being set to a default value, or by brute force (which may be less practical in an outside environment) Depending on the sensitivity of the information being discussed, this scenario can be extremely compromising.
An adversary may also use a technique called Bluebugging, which is similar to Bluesnarfing but requires the adversary to be between 10-15 meters of the target device. Bluebugging creates a backdoor for an attacker to listen/record phone calls, forward calls, send SMS and retrieve the phonebook.

1123
Audio Capture

1125
Video Capture

CAPEC Content Team
The MITRE Corporation
2018-07-31

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Example_Instances, References
The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.
High

The use of the file must be controlled by the file extension.

Applications should insure that the content of the file is consistent with format it is expecting, and not depend solely on the file extension.

1036.007
Masquerading: Double File Extension

CAPEC Content Team
The MITRE Corporation
2018-05-31

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.
High

The operating system must support a file system that allows for alternate data storage for a file.

Many tools are available to search for the hidden data. Scan regularly for such data using one of these tools.

1001.002
Data Obfuscation: Steganography

1027.003
Obfuscated Files or Information: Steganography

1027.004
Obfuscated Files or Information: Compile After Delivery

1218.001
Signed Binary Proxy Execution: Compiled HTML File

1221
Template Injection

CAPEC Content Team
The MITRE Corporation
2018-05-31

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
The adversary exploits an application that allows for the copying of sensitive data or information by collecting information copied to the clipboard. Data copied to the clipboard can be accessed by other applications, such as malware built to exfiltrate or log clipboard contents on a periodic basis. In this way, the adversary aims to garner information to which they are unauthorized.
Low
Low

1
Explore
[Find an application that allows copying sensititve data to clipboad] An adversary first needs to find an application that allows copying and pasting of sensitive information. This could be an application that prints out temporary passwords to the screen, private email addresses, or any other sensitive information or data

2
Experiment
[Target users of the application] An adversary will target users of the application in order to obtain the information in their clipboard on a periodic basic
Install malware on a user's system designed to log clipboard contents periodically
Get the user to click on a malicious link that will bring them to an application to log the contents of the clipboard

3
Exploit
[Follow-up attack] Use any sensitive information found to carry out a follow-up attack

The adversary must have a means (i.e., a pre-installed tool or background process) by which to collect data from the clipboard and store it. That is, when the target copies data to the clipboard (e.g., to paste into another application), the adversary needs some means of capturing that data in a third location.

To deploy a hidden process or malware on the system to automatically collect clipboard data.

Confidentiality
Read Data

While copying and pasting of data with the clipboard is a legitimate and practical function, certain situations and context may require the disabling of this feature. Just as certain applications disable screenshot capability, applications that handle highly sensitive information should consider disabling copy and paste functionality.
Employ a robust identification and audit/blocking via using an allowlist of applications on your system. Malware may contain the functionality associated with this attack pattern.

1115
Clipboard Data

CAPEC Content Team
2018-07-31

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description, Mitigations, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Execution_Flow
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.
Medium

An adversary has access to the file system of a system.

Confidentiality
Read Data

Verify that files have proper access controls set, and reduce the storage of sensitive information to only what is necessary.

Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Adversaries may search network shares on computers they have compromised to find files of interest.

1039
Data from Network Shared Drive

1552.001
Unsecured Credentials: Credentials in Files

1552.003
Unsecured Credentials: Bash History

1552.004
Unsecured Credentials: Private Keys

1552.006
Unsecured Credentials: Group Policy Preferences

CAPEC Content Team
The MITRE Corporation
2018-05-04

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.
Low
High

The target must fail to verify the integrity of the DLL before using them.

Trick the operating system in loading a malicious DLL instead of a legitimate DLL.

Integrity
Execute Unauthorized Commands
Bypass Protection Mechanism

Prevent unknown DLLs from loading through using an allowlist policy.
Patch installed applications as soon as new updates become available.
Properly restrict the location of the software being used.
Use of sxstrace.exe on Windows as well as manual inspection of the manifests.
Require code signing and avoid using relative paths for resources.

1574.002
Hijack Execution Flow:DLL Side-Loading

CAPEC Content Team
The MITRE Corporation
2018-07-31

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Taxonomy_Mappings
Adversaries know that certain binaries will be regularly executed as part of normal processing. If these binaries are not protected with the appropriate file system permissions, it could be possible to replace them with malware. This malware might be executed at higher system permission levels. A variation of this pattern is to discover self-extracting installation packages that unpack binaries to directories with weak file permissions which it does not clean up appropriately. These binaries can be replaced by malware, which can then be executed.
High

The attacker must be able to place the malicious binary on the target machine.

Insure that binaries commonly used by the system have the correct file permissions. Set operating system policies that restrict privilege elevation of non-Administrators. Use auditing tools to observe changes to system services.

The installer for a previous version of Firefox would use a DLL maliciously placed in the default download directory instead of the existing DLL located elsewhere, probably due to DLL hijacking. This DLL would be run with administrator privileges if the installer has those privileges.
By default, the Windows screensaver application SCRNSAVE.exe leverages the scrnsave.scr Portable Executable (PE) file in C:\Windows\system32\. This value is set in the registry at HKEY_CURRENT_USER\Control Panel\Desktop, which can be modified by an adversary to instead point to a malicious program. This program would then run any time the SCRNSAVE.exe program is activated and with administrator privileges. An adversary may additionally modify other registry values within the same location to set the SCRNSAVE.exe program to run more frequently.

1505.005
Server Software Component: Terminal Services DLL

1554
Compromise Client Software Binary

1574.005
Hijack Execution Flow:Executable Installer File Permissions Weakness

Binary planting

CAPEC Content Team
The MITRE Corporation
2018-05-31

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Example_Instances, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.
Medium
Medium

The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).

Once the adversary has logical access (which can potentially require high knowledge and skill level), the adversary needs only the capability and facility to navigate the system through the OS graphical user interface or the command line. The adversary, or their malware, can simply employ a set of commands that search for shared drives on the system (e.g., net view \\remote system or net share).

None: No specialized resources are required to execute this type of attack.

Confidentiality
Read Data
The adversary is potentially able to identify the location of sensitive information or lateral pathways through the network.

Identify unnecessary system utilities or potentially malicious software that may contain functionality to identify network share information, and audit and/or block them by using allowlist tools.

1135
Network Share Discovery

CAPEC Content Team
The MITRE Corporation
2018-07-31

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Skills_Required

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns
An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. An adversary can obtain any one of these tickets (e.g. Service Ticket, Ticket Granting Ticket, Silver Ticket, or Golden Ticket) to authenticate to a system/resource without needing the account's credentials. Depending on the ticket obtained, the adversary may be able to access a particular resource or generate TGTs for any account within an Active Directory Domain.
Low
High

The adversary needs physical access to the victim system.
The use of a third-party credential harvesting tool.

Determine if Kerberos authentication is used on the server.
The adversary uses a third-party tool to obtain the necessary tickets to execute the attack.

Integrity
Gain Privileges

Reset the built-in KRBTGT account password twice to invalidate the existence of any current Golden Tickets and any tickets derived from them.
Monitor system and domain logs for abnormal access.

Bronze Butler (also known as Tick), has been shown to leverage forged Kerberos Ticket Granting Tickets (TGTs) and Ticket Granting Service (TGS) tickets to maintain administrative access on a number of systems. [REF-584]

1550.003
Use Alternate Authentication Material:Pass The Ticket

CAPEC Content Team
2018-07-31

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description, Example_Instances, References, Related_Attack_Patterns, Related_Weaknesses, Taxonomy_Mappings
Adversaries may attempt to obtain information about attached peripheral devices and components connected to a computer system. Examples may include discovering the presence of iOS devices by searching for backups, analyzing the Windows registry to determine what USB devices have been connected, or infecting a victim system with malware to report when a USB device has been connected. This may allow the adversary to gain additional insight about the system or network environment, which may be useful in constructing further attacks.
Low
Medium

The adversary needs either physical or remote access to the victim system.

The adversary needs to be able to infect the victim system in a manner that gives them remote access.
If analyzing the Windows registry, the adversary must understand the registry structure to know where to look for devices.

Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

1120
Peripheral Device Discovery

CAPEC Content Team
2018-07-31

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Skills_Required