auren-research/cyber-sec huggingface dataset:
An adversary exploits a weakness in authorization to gather system-specific data and sensitive information within a registry (e.g., Windows Registry, Mac plist). These contain information about the system configuration, software, operating system, and security. The adversary can leverage information gathered in order to carry out further attacks.
Medium
Medium

1
Explore
[Gain logical access to system] An adversary must first gain logical access to the system it wants to gather registry information from,
Obtain user account credentials and access the system
Plant malware on the system that will give remote logical access to the adversary

2
Experiment
[Determine if the permissions are correct] Once logical access is gained, an adversary will determine if they have the proper permissions, or are authorized, to view registry information. If they do not, they will need to escalate privileges on the system through other means

3
Experiment
[Peruse registry for information] Once an adversary has access to a registry, they will gather all system-specific data and sensitive information that they deem useful.

4
Exploit
[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack

The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).
The adversary must have capability to navigate the operating system to peruse the registry.

Once the adversary has logical access (which can potentially require high knowledge and skill level), the adversary needs only the capability and facility to navigate the system through the OS graphical user interface or the command line.

None: No specialized resources are required to execute this type of attack.

Confidentiality
Read Data
The adversary is able to read sensitive information about the system in the registry.

Employ a robust and layered defensive posture in order to prevent unauthorized users on your system.
Employ robust identification and audit/blocking via using an allowlist of applications on your system. Unnecessary applications, utilities, and configurations will have a presence in the system registry that can be leveraged by an adversary through this attack pattern.

1005
Data from Local System

1012
Query Registry

1552.002
Unsecured Credentials: Credentials in Registry

CAPEC Content Team
The MITRE Corporation
2018-05-15

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Execution_Flow

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary gathers sensitive information by exploiting the system's screen capture functionality. Through screenshots, the adversary aims to see what happens on the screen over the course of an operation. The adversary can leverage information gathered in order to carry out further attacks.
Medium
Medium

The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).

Once the adversary has logical access (which can potentially require high knowledge and skill level), the adversary needs only to leverage the relevant command for screen capture.

None: No specialized resources are required to execute this type of attack.

Confidentiality
Read Data
The adversary is able to capture potentially sensitive information and processes as they appear on the screen.

Identify potentially malicious software that may have functionality to acquire screen captures, and audit and/or block it by using allowlist tools.
While screen capture is a legitimate and practical function, certain situations and context may require the disabling of this feature.

1113
Screen Capture

1513
Screen Capture

CAPEC Content Team
2018-07-31

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.
Low
Medium

The use of the file must be controlled by the file extension.

Confidentiality
Integrity
Availability
Execute Unauthorized Commands

File extensions should be checked to see if non-visible characters are being included.

1036.006
Masquerading:Space after Filename

CAPEC Content Team
The MITRE Corporation
2018-05-31

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
High

The web server is susceptible to one of the various web application exploits that allows for uploading a shell file.

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Gain Privileges

Confidentiality
Integrity
Availability
Execute Unauthorized Commands

Make sure your web server is up-to-date with all patches to protect against known vulnerabilities.
Ensure that the file permissions in directories on the web server from which files can be execute is set to the "least privilege" settings, and that those directories contents is controlled by an allowlist.

1505.003
Server Software Component:Web Shell

CAPEC Content Team
The MITRE Corporation
2018-05-31

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations
An adversary intercepts a form of communication (e.g. text, audio, video) by way of software (e.g., microphone and audio recording application), hardware (e.g., recording equipment), or physical means (e.g., physical proximity). The goal of eavesdropping is typically to gain unauthorized access to sensitive information about the target for financial, personal, political, or other gains. Eavesdropping is different from a sniffing attack as it does not take place on a network-based communication channel (e.g., IP traffic). Instead, it entails listening in on the raw audio source of a conversation between two or more parties.
Medium

The adversary typically requires physical proximity to the target's environment, whether for physical eavesdropping or for placing recording equipment. This is not always the case for software-based eavesdropping, if the adversary has the capability to install malware on the target system that can activate a microphone and record audio digitally.

For logical eavesdropping, some equipment may be necessary (e.g., microphone, tape recorder, etc.). For physical eavesdropping, only proximity is required.

Confidentiality
Other
The adversary gains unauthorized access to information.

Be mindful of your surroundings when discussing sensitive information in public areas.
Implement proper software restriction policies to only allow authorized software on your environment. Use of anti-virus and other security monitoring and detecting tools can aid in this too. Closely monitor installed software for unusual behavior or activity, and implement patches as soon as they become available.
If possible, physically disable the microphone on your machine if it is not needed.

1111
Multi-Factor Authentication Interception

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions.
In addition to this, adding data to a file also changes the file's hash, frustrating security tools that look for known bad files by their hash.

High
High

Accountability
Hide Activities
Bypass Protection Mechanism

Integrity
Modify Data

Adding data to change the checksum of a file and can be used to avoid hash-based denylists and static anti-virus signatures.

1027.001
Obfuscated Files or Information:Binary padding

CAPEC Content Team
The MITRE Corporation
2020-07-30

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Example_Instances
An attackers uses identify or content spoofing to trick a client into performing an automated software update from a malicious source. A malicious automated software update that leverages spoofing can include content or identity spoofing as well as protocol spoofing. Content or identity spoofing attacks can trigger updates in software by embedding scripted mechanisms within a malicious web page, which masquerades as a legitimate update source. Scripting mechanisms communicate with software components and trigger updates from locations specified by the attackers' server. The result is the client believing there is a legitimate software update available but instead downloading a malicious update from the attacker.
High
High

Access Control
Availability
Confidentiality
Execute Unauthorized Commands

An example of the spoofing strategy would be the eTrust Antivirus Webscan Automated Update Remote Code Execution vulnerability (CVE-2006-3976) and (CVE-2006-3977) whereby an ActiveX control could be remotely manipulated by an attacker controlled web page to download and execute the attackers' code without integrity checking.

1072
Software Deployment Tools

CAPEC Content Team
The MITRE Corporation
2020-12-17

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.
Medium
Medium

1
Explore
[Scan for Bluetooth Enabled Devices] Using BlueZ along with an antenna, an adversary searches for devices with Bluetooth on.
Note the MAC address of the device you want to attack.

2
Experiment
[Change L2CAP Packet Length] The adversary must change the L2CAP packet length to create packets that will overwhelm a Bluetooth enabled device.
An adversary downloads and installs BlueZ, the standard Bluetooth utility package for Linux.

3
Exploit
[Flood] An adversary sends the packets to the target device, and floods it until performance is degraded.

The system/application has Bluetooth enabled.

An adversary only needs a Linux machine along with a Bluetooth adapter, which is extremely common.

Performance is degraded or halted by incoming L2CAP packets.

Availability
Unreliable Execution
Resource Consumption

Disable Bluetooth when not being used.
When using Bluetooth, set it to hidden or non-discoverable mode.

1498.001
Network Denial of Service: Direct Network Flood

1499.001
Endpoint Denial of Service: OS Exhaustion Flood

CAPEC Content Team
The MITRE Corporation
2021-06-24

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.
Medium
High

1
Explore
[Find disguise and target] The adversary starts the Bluetooth service on the attacking device and searches for nearby listening devices.
Knowledge of a trusted MAC address.
Scanning for devices other than the target that may be trusted.

2
Experiment
[Disguise] Using the MAC address of the device the adversary wants to impersonate, they may use a tool such as spooftooth or macchanger to spoof their Bluetooth address and attempt to authenticate with the target.

3
Exploit
[Use device capabilities to accomplish goal] Finally, if authenticated successfully the adversary can perform tasks/information gathering dependent on the target's capabilities and connections.

Knowledge of a target device's list of trusted connections.

Adversaries must be capable of using command line Linux tools.
Adversaries must be in close proximity to Bluetooth devices.

Integrity
An adversary will be impersonating another Bluetooth device, and may gain access to information pertaining to that user along with the ability to manipulate other information.

Confidentiality
An adversary will have unauthorized access to information.

Disable Bluetooth in public places.
Verify incoming Bluetooth connections; do not automatically trust.
Change default PIN passwords and always use one when connecting.

CAPEC Content Team
The MITRE Corporation
2021-06-24

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns
An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.
Low
High

1
Explore
[Discovery] Using an established Person in the Middle setup, search for Bluetooth devices beginning the authentication process.
Use packet capture tools.

2
Experiment
[Change the entropy bits] Upon recieving the initial key negotiation packet from the master, the adversary modifies the entropy bits requested to 1 to allow for easy decryption before it is forwarded.

3
Exploit
[Capture and decrypt data] Once the entropy of encryption is known, the adversary can capture data and then decrypt on their device.

Person in the Middle network setup.

Ability to modify packets.

Bluetooth adapter, packet capturing capabilities.

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism

Integrity
Modify Data

Newer Bluetooth firmwares ensure that the KNOB is not negotaited in plaintext. Update your device.

Given users Alice, Bob and Charlie (Charlie being the attacker), Alice and Bob begin to agree on an encryption key when connecting. While Alice sends a message to Bob that an encryption key with 16 bytes of entropy should be used, Charlie changes this to 1 and forwards the request to Bob and continues forwarding these packets until authentication is successful.

1565.002
Data Manipulation: Transmitted Data Manipulation

CAPEC Content Team
The MITRE Corporation
2021-06-24

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary with access to an organization’s software update infrastructure inserts malware into the content of an outgoing update to fielded systems where a wide range of malicious effects are possible. With the same level of access, the adversary can alter a software update to perform specific malicious acts including granting the adversary control over the software’s normal functionality.

Medium
High

1
Explore
[Identify software with frequent updates] The adversary must first identify a target software that has updates at least with some frequency, enough that there is am update infrastructure.

2
Experiment
[Gain access to udpate infrastructure] The adversary must then gain access to the organization's software update infrastructure. This can either be done by gaining remote access from outside the organization, or by having a malicious actor inside the organization gain access. It is often easier if someone within the organization gains access.

3
Exploit
[Alter the software update] Through access to the software update infrastructure, an adversary will alter the software update by injecting malware into the content of an outgoing update.

An adversary would need to have penetrated an organization’s software update infrastructure including gaining access to components supporting the configuration management of software versions and updates related to the software maintenance of customer systems.

Skills required include the ability to infiltrate the organization’s software update infrastructure either from the Internet or from within the organization, including subcontractors, and be able to change software being delivered to customer/user systems in an undetected manner.

Access Control
Gain Privileges

Authorization
Execute Unauthorized Commands

Integrity
Modify Data

Confidentiality
Read Data

Have a Software Assurance Plan that includes maintaining strict configuration management control of source code, object code and software development, build and distribution tools; manual code reviews and static code analysis for developmental software; and tracking of all storage and movement of code.
Require elevated privileges for distribution of software and software updates.

A subcontractor to a software developer injects maliciously altered software updates into an automated update process that distributes to government and commercial customers software containing a hidden backdoor.

1195.002
Supply Chain Compromise: Compromise Software Supply Chain

CAPEC Content Team
The MITRE Corporation
2021-06-24

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Execution_Flow

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary with the ability to alter tools used in a development environment causes software to be developed with maliciously modified tools. Such tools include requirements management and database tools, software design tools, configuration management tools, compilers, system build tools, and software performance testing and load testing tools. The adversary then carries out malicious acts once the software is deployed including malware infection of other systems to support further compromises.
Low
High

An adversary would need to have access to a targeted developer’s development environment and in particular to tools used to design, create, test and manage software, where the adversary could ensure malicious code is included in software packages built through alteration or substitution of tools in the environment used in the development of software.

Ability to leverage common delivery mechanisms (e.g., email attachments, removable media) to infiltrate a development environment to gain access to software development tools for the purpose of malware insertion into an existing tool or replacement of an existing tool with a maliciously altered copy.

Integrity
Execute Unauthorized Commands

Access Control
Gain Privileges

Confidentiality
Modify Data
Read Data

Have a security concept of operations (CONOPS) for the development environment that includes: Maintaining strict security administration and configuration management of requirements management and database tools, software design tools, configuration management tools, compilers, system build tools, and software performance testing and load testing tools.
Avoid giving elevated privileges to developers.

An adversary with access to software build tools inside an Integrated Development Environment IDE alters a script used for downloading dependencies from a dependent code repository where the script has been changed to include malicious code implanted in the repository by the adversary.

1127
Trusted Developer Utilities Proxy Execution

1195.001
Supply Chain Compromise: Compromise Software Dependencies and Development Tools

CAPEC Content Team
The MITRE Corporation
2021-06-24

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated References

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary with access to functional requirements for an application specific integrated circuit (ASIC), a chip designed/customized for a singular particular use, maliciously alters requirements derived from originating capability needs. In the chip manufacturing process, requirements drive the chip design which, when the chip is fully manufactured, could result in an ASIC which may not meet the user’s needs, contain malicious functionality, or exhibit other anomalous behaviors thereby affecting the intended use of the ASIC.
Low
High

An adversary would need to have access to a foundry’s or chip maker’s requirements management system that stores customer requirements for ASICs, requirements upon which the design of the ASIC is based.

An adversary would need experience in designing chips based on functional requirements in order to manipulate requirements in such a way that deviations would not be detected in subsequent stages of ASIC manufacture and where intended malicious functionality would be available to the adversary once integrated into a system and fielded.

Integrity
Alter Execution Logic

Utilize DMEA’s (Defense Microelectronics Activity) Trusted Foundry Program members for acquisition of microelectronic components.
Ensure that each supplier performing hardware development implements comprehensive, security-focused configuration management including for hardware requirements and design.
Require that provenance of COTS microelectronic components be known whenever procured.
Conduct detailed vendor assessment before acquiring COTS hardware.

An adversary with access to ASIC functionality requirements for various customers, targets a particular customer’s ordered lot of ASICs by altering its functional requirements such that the ASIC design will result in a manufactured chip that does not meet the customer’s capability needs.

1195.003
Supply Chain Compromise: Compromise Hardware Supply Chain

CAPEC Content Team
The MITRE Corporation
2021-06-24

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated References

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings