auren-research/cyber-sec huggingface dataset:
The adversary incites a behavior from the target by manipulating something of influence. This is commonly associated with financial, social, or ideological incentivization. Examples include monetary fraud, peer pressure, and preying on the target's morals or ethics. The most effective incentive against one target might not be as effective against another, therefore the adversary must gather information about the target's vulnerability to particular incentives.
Low
Low

The adversary must have the means and knowledge of how to communicate with the target in some manner.The adversary must have knowledge of the incentives that would influence the actions of the specific target.

The adversary requires strong inter-personal and communication skills.

Confidentiality
Integrity
Availability
Other
Attacks that successfully incentivize the target into performing an action beneficial to the adversary can result in a variety of consequences that negatively affect the confidentiality, availability, and/or integrity of an application or system.

An organization should provide regular, robust cybersecurity training to its employees to prevent social engineering attacks.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Methods_of_Attack, References, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

Target Influence via Manipulation of Incentives
The adversary shapes the target's actions or behavior by focusing on the ways human interact and learn, leveraging such elements as cognitive and social psychology. In a variety of ways, a target can be influenced to behave or perform an action through capitalizing on what scholarship and research has learned about how and why humans react to specific scenarios and cues.
Low
Low

The adversary must have the means and knowledge of how to communicate with the target in some manner.

The adversary requires strong inter-personal and communication skills.

Confidentiality
Integrity
Availability
Other
Attacks that successfully influence the target into performing an action via psychological principles can result in a variety of consequences that negatively affect the confidentiality, availability, and/or integrity of an application or system.

An organization should provide regular, robust cybersecurity training to its employees to prevent social engineering attacks.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Methods_of_Attack, References, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

Target Influence via Psychological Principles
The adversary tailors their communication to the language and thought patterns of the target thereby weakening barriers or reluctance to communication. This method is a way of building rapport with a target by matching their speech patterns and the primary ways or dominant senses with which they make abstractions. This technique can be used to make the target more receptive to sharing information because the adversary has adapted their communication forms to match those of the target. When skillfully employed, the target is likely to be unaware that they are being manipulated.
Low

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Description Summary

Target Influence via Modes of Thinking
An attacker utilizes a technique to insinuate commands to the subconscious mind of the target via communication patterns. The human buffer overflow methodology does not rely on over-stimulating the mind of the target, but rather embedding messages within communication that the mind of the listener assembles at a subconscious level. The human buffer-overflow method is similar to subconscious programming to the extent that messages are embedded within the message.

The fundamental difference is that embedded messages have a complete semantic quality, rather than mere imagery, and the mind of the target tends to key off of particular dominant patterns. The remaining information, carefully structured, speaks directly to the subconscious with a subtle, indirect, command. The effect is to produce a pattern of thinking that the attacker has predetermined but is buried within the message and not overtly stated. Structuring a human "buffer overflow" requires precise attention to detail and the use of information in a manner that distracts the conscious mind from the message the subconscious is receiving.

Low

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An attacker modifies a technology, product, or component during a stage in its manufacture for the purpose of carrying out an attack against some entity involved in the supply chain lifecycle. There are an almost limitless number of ways an attacker can modify a technology when they are involved in its manufacture, as the attacker has potential inroads to the software composition, hardware design and assembly, firmware, or basic design mechanics. Additionally, manufacturing of key components is often outsourced with the final product assembled by the primary manufacturer. The greatest risk, however, is deliberate manipulation of design specifications to produce malicious hardware or devices. There are billions of transistors in a single integrated circuit and studies have shown that fewer than 10 transistors are required to create malicious functionality.

1195
Supply Chain Compromise

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

Integrity Modification During Manufacture
An attacker undermines the integrity of a product, software, or technology at some stage of the distribution channel. The core threat of modification or manipulation during distribution arise from the many stages of distribution, as a product may traverse multiple suppliers and integrators as the final asset is delivered. Components and services provided from a manufacturer to a supplier may be tampered with during integration or packaging.

A malicious OEM provider, or OEM provider employee or contractor, may install software, or modify existing code, during distribution.
External contractors involved in the packaging or testing of products or components may install software, or modify existing code, during distribution.

1195
Supply Chain Compromise

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Weaknesses, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

Integrity Modification During Distribution
An adversary exploits a weakness in the system maintenance process and causes a change to be made to a technology, product, component, or sub-component or a new one installed during its deployed use at the victim location for the purpose of carrying out an attack.
Low
High

Influence over the deployed system at a victim location.

Integrity
Execute Unauthorized Commands

1195.003
Supply Chain Compromise: Compromise Hardware Supply Chain

1200
Hardware Additions

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Description Summary, Examples-Instances, References

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Description, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

Integrity Modification During Deployed Use
An adversary installs or adds malicious logic (also known as malware) into a seemingly benign component of a fielded system. This logic is often hidden from the user of the system and works behind the scenes to achieve negative impacts. With the proliferation of mass digital storage and inexpensive multimedia devices, Bluetooth and 802.11 support, new attack vectors for spreading malware are emerging for things we once thought of as innocuous greeting cards, picture frames, or digital projectors. This pattern of attack focuses on systems already fielded and used in operation as opposed to systems and their components that are still under development and part of the supply chain.
Medium
High

Access to the component currently deployed at a victim location.

Authorization
Execute Unauthorized Commands

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Description Summary

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Weaknesses, Typical_Likelihood_of_Exploit, Typical_Severity

Malicious Logic Inserted Into to Product
An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part of the supply chain.
Medium
High

Access to the software currently deployed at a victim location. This access is often obtained by leveraging another attack pattern to gain permissions that the adversary wouldn't normally have.

Authorization
Execute Unauthorized Commands

Leverage anti-virus products to detect and quarantine software with known virus.

1195.001
Supply Chain Compromise: Compromise Software Dependencies and Development Tools

1195.002
Supply Chain Compromise: Compromise Software Supply Chain

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Description Summary, Examples-Instances, References, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Examples-Instances, References, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses

Malicious Logic Inserted Into Product Software
Malicious Logic Inserted Into To Product Software
An adversary modifies a technology, product, or component during its development to acheive a negative impact once the system is deployed. The goal of the adversary is to modify the system in such a way that the negative impact can be leveraged when the system is later deployed. Development alteration attacks may include attacks that insert malicious logic into the system's software, modify or replace hardware components, and other attacks which negatively impact the system during development. These attacks generally require insider access to modify source code or to tamper with hardware components. The product is then delivered to the user where the negative impact can be leveraged at a later time.
Medium
High

Access to the system during the development phase to alter and/or modify software and hardware components. This access is often obtained via insider access or by leveraging another attack pattern to gain permissions that the adversary wouldn't normally have.

Authorization
Execute Unauthorized Commands

Availability
Unreliable Execution

Integrity
Alter Execution Logic

Assess software and software components during development and prior to deployment to ensure that they function as intended and without any malicious functionality.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Description Summary, References, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

Malicious Logic Insertion into Product Software via Externally Manipulated Component
An adversary exploits a configuration management system so that malicious logic is inserted into a software products build, update or deployed environment. If an adversary can control the elements included in a product's configuration management for build they can potentially replace, modify or insert code files containing malicious logic. If an adversary can control elements of a product's ongoing operational configuration management baseline they can potentially force clients receiving updates from the system to install insecure software when receiving updates from the server.

Configuration management servers operate on the basis of a client pool, instructing each client on which software to install. In some cases the configuration management server will automate the software installation process. A malicious insider or an adversary who has compromised the server can alter the software baseline that clients must install, allowing the adversary to compromise a large number of satellite machines using the configuration management system. If an adversary can control elements of a product's configuration management for its deployed environment they can potentially alter fundamental security properties of the system based on assumptions that secure configurations are in place. It is also worth noting that this attack can occur during initial product development or throughout a product's sustainment.

Medium
High

Access to the configuration management system during deployment or currently deployed at a victim location. This access is often obtained via insider access or by leveraging another attack pattern to gain permissions that the adversary wouldn't normally have.

Authorization
Execute Unauthorized Commands

Assess software during development and prior to deployment to ensure that it functions as intended and without any malicious functionality.
Leverage anti-virus products to detect and quarantine software with known virus.

In 2016, the policy-based configuration management system Chef was shown to be vulnerable to remote code execution attacks based on its Chef Manage add-on improperly deserializing user-driven cookie data. This allowed unauthenticated users the ability to craft cookie data that executed arbitrary code with the web server's privileges. [REF-706]

1195.001
Supply Chain Compromise: Compromise Software Dependencies and Development Tools

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Example_Instances, Extended_Description, References

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Description, Extended_Description, Related_Attack_Patterns, Taxonomy_Mappings
An adversary modifies the design of a technology, product, or component to acheive a negative impact once the system is deployed. In this type of attack, the goal of the adversary is to modify the design of the system, prior to development starting, in such a way that the negative impact can be leveraged when the system is later deployed. Design alteration attacks differ from development alteration attacks in that design alteration attacks take place prior to development and which then may or may not be developed by the adverary. Design alteration attacks include modifying system designs to degrade system performance, cause unexpected states or errors, and general design changes that may lead to additional vulnerabilities. These attacks generally require insider access to modify design documents, but they may also be spoofed via web communications. The product is then developed and delivered to the user where the negative impact can be leveraged at a later time.
Medium
High

Access to system design documentation prior to the development phase. This access is often obtained via insider access or by leveraging another attack pattern to gain permissions that the adversary wouldn't normally have.
Ability to forge web communications to deliver modified design documentation.

Authorization
Execute Unauthorized Commands

Availability
Unreliable Execution

Integrity
Alter Execution Logic

Assess design documentation prior to development to ensure that they function as intended and without any malicious functionality.
Ensure that design documentation is saved in a secure location and has proper access controls set in place to avoid unnecessary modification.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Description Summary, References, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns

Malicious Logic Insertion into Product Software during Update
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.
Medium
High

Access to the software currently deployed at a victim location. This access is often obtained by leveraging another attack pattern to gain permissions that the adversary wouldn't normally have.

Authorization
Execute Unauthorized Commands

Leverage anti-virus products to detect and quarantine software with known virus.

1027.009
Obfuscated Files or Information: Embedded Payloads

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, References, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses, Taxonomy_Mappings

Malware Infection into Product Software
This attack pattern has been deprecated as it is a duplicate of CAPEC-448 : Malware Infection into Product Software. Please refer to this other pattern going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Prerequisites, Description Summary, Examples-Instances, References, Related_Attack_Patterns

Malware Propagation via USB Stick
This attack pattern has been deprecated as it is a duplicate of CAPEC-448 : Embed Virus into DLL. Please refer to this other pattern going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Description Summary, References, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Description

Malware Propagation via USB U3 Autorun
This attack pattern has been deprecated as it is a duplicate of CAPEC-448 : Malware Infection into Product Software. Please refer to this other pattern going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Description Summary, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

Malware Propagation via Infected Peripheral Device
An adversary inserts malicious logic into hardware, typically in the form of a computer virus or rootkit. This logic is often hidden from the user of the hardware and works behind the scenes to achieve negative impacts. This pattern of attack focuses on hardware already fielded and used in operation as opposed to hardware that is still under development and part of the supply chain.
Medium
High

Access to the hardware currently deployed at a victim location.

Authorization
Execute Unauthorized Commands

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, References, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Attack_Patterns

Malicious Logic Insertion into Product Hardware
This attack pattern has been deprecated as it is a duplicate of CAPEC-452 : Malicious Logic Insertion into Product Hardware. Please refer to this other pattern going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Description Summary, References, Related_Attack_Patterns

Malicious Logic Insertion via Counterfeit Hardware
This attack pattern has been deprecated as it is a duplicate of CAPEC-452 : Malicious Logic Insertion into Product Hardware. Please refer to this other pattern going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Prerequisites, Description Summary, References, Related_Attack_Patterns

Modification of Existing Components with Counterfeit Hardware
This attack pattern has been deprecated as it is a duplicate of CAPEC-457 : Malicious Logic Insertion into Product Hardware. Please refer to this other pattern going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Prerequisites, Description Summary, Examples-Instances, References, Related_Attack_Patterns

Malicious Logic Insertion via Inclusion of Counterfeit Hardware Components