auren-research/cyber-sec huggingface dataset:
An adversary modifies file contents by adding data to files for several reasons. Many different attacks could “follow” this pattern resulting in numerous outcomes. Adding data to a file could also result in a Denial of Service condition for devices with limited storage capacity.

High
Medium

Availability
Resource Consumption
Denial of Service

Integrity
Modify Data

An adversary could potentially increase file sizes on devices containing limited storage resources, such as SCADA or IOT devices, resulting in denial of service conditions.

1027.001
Obfuscated Files or Information:Binary Padding

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Consequences, Description, Example_Instances, Likelihood_Of_Attack, Taxonomy_Mappings, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns
An adversary exploits functionality meant to identify information about the currently running processes on the target system to an authorized user. By knowing what processes are running on the target system, the adversary can learn about the target environment as a means towards further malicious behavior.
Low
Low

The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.

Confidentiality
Other

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

Identify programs that may be used to acquire process information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

On a Windows system, the command, "tasklist," displays information about processes. The same function on a Mac OS system is done with the command, "ps."
In addition to manual discovery of running processes, an adversary can develop malware that carries out this attack pattern before subsequent malicious action.

1057
Process Discovery

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Examples-Instances, References, Related_Weaknesses, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations
An adversary exploits functionality meant to identify information about the services on the target system to an authorized user. By knowing what services are registered on the target system, the adversary can learn about the target environment as a means towards further malicious behavior. Depending on the operating system, commands that can obtain services information include "sc" and "tasklist/svc" using Tasklist, and "net start" using Net.
Low
Low

The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.

Confidentiality
Other

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

Identify programs that may be used to acquire service information and block them by using a software restriction policy or tools that restrict program execution by uaing a process allowlist.

1007
System Service Discovery

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, References, Related_Weaknesses, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations
An adversary exploits functionality meant to identify information about the domain accounts and their permissions on the target system to an authorized user. By knowing what accounts are registered on the target system, the adversary can inform further and more targeted malicious behavior. Example Windows commands which can acquire this information are: "net user" and "dsquery".
Low
Low

The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.

Confidentiality
Other

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

Identify programs that may be used to acquire account information and block them by using a software restriction policy or tools that restrict program execution by uysing a process allowlist.

1087
Account Discovery

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, References, Related_Weaknesses, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations
An adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command which can list local groups is "net localgroup".
Low
Low

The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.

Confidentiality
Other

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

Identify programs (such as "net") that may be used to enumerate local group permissions and block them by using a software restriction Policy or tools that restrict program execution by using a process allowlist.

1069
Permission Groups Discovery

1615
Group Policy Discovery

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, References, Related_Weaknesses, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary exploits functionality meant to identify information about the primary users on the target system to an authorized user. They may do this, for example, by reviewing logins or file modification times. By knowing what owners use the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command that may accomplish this is "dir /A ntuser.dat". Which will display the last modified time of a user's ntuser.dat file when run within the root folder of a user. This time is synonymous with the last time that user was logged in.
Low
Low

The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.
Administrator permissions are required to view the home folder of other users.

Confidentiality
Other

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

Ensure that proper permissions on files and folders are enacted to limit accessibility.

1033
System Owner/User Discovery

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, References, Related_Weaknesses, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction
An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.
Medium
Medium

The adversary must have the capability to interact with the configuration of the targeted system.

None: No specialized resources are required to execute this type of attack.

Availability
Hide Activities
By disabling certain security tools, the adversary can hide malicious activity and avoid detection.

Ensure proper permissions are in place to prevent adversaries from altering the execution status of security tools.

1556.006
Modify Authentication Process: Multi-Factor Authentication

1562.001
Impair Defenses: Disable or Modify Tools

1562.002
Impair Defenses: Disable Windows Event Logging

1562.004
Impair Defenses: Disable or Modify System Firewall

1562.007
Impair Defenses: Disable or Modify Cloud Firewall

1562.008
Impair Defenses: Disable Cloud Logs

1562.009
Impair Defenses: Safe Mode Boot

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, References, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Taxonomy_Mappings
Winlogon is a part of Windows that performs logon actions. In Windows systems prior to Windows Vista, a registry key can be modified that causes Winlogon to load a DLL on startup. Adversaries may take advantage of this feature to load adversarial code at startup.

Changes to registry entries in "HKLM\Software\Microsoft\Windows NT\Winlogon\Notify" that do not correlate with known software, patch cycles, etc are suspicious. New DLLs written to System32 which do not correlate with known good software or patching may be suspicious.

1547.004
Boot or Logon Autostart Execution: Winlogon helper DLL

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.

High
High

The attacker needs to be able to identify HTTP Get URLs. The Get methods must be set to call applications that perform operations other than get such as update and delete.

It is relatively straightforward to identify an HTTP Get method that changes state on the server side and executes against an over-privileged system interface

Integrity
Modify Data

Confidentiality
Access Control
Authorization
Gain Privileges

Design: Enforce principle of least privilege
Implementation: Ensure that HTTP Get methods only retrieve state and do not alter state on the server side
Implementation: Ensure that HTTP methods have proper ACLs based on what the functionality they expose

The HTTP Get method is designed to retrieve resources and not to alter the state of the application or resources on the server side. However, developers can easily code programs that accept a HTTP Get request that do in fact create, update or delete data on the server. Both Flickr (http://www.flickr.com/services/api/flickr.photosets.delete.html) and del.icio.us (http://del.icio.us/api/posts/delete) have implemented delete operations using standard HTTP Get requests. These HTTP Get methods do delete data on the server side, despite being called from Get which is not supposed to alter state.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Description, Extended_Description
An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.
Low
Low

The adversary must have logical access to the target network and system.

The adversary needs to know basic linux commands.

Confidentiality
Read Data

Keep patches up to date by installing weekly or daily if possible.
Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

1082
System Information Discovery

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated @Name, Description

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses

Application Footprinting
Adversaries may attempt to get a listing of security tools that are installed on the system and their configurations. This may include security related system features (such as a built-in firewall or anti-spyware) as well as third-party security software.

Identify programs that may be used to acquire security tool information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

1518.001
Software Discovery:Security Software Discovery

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Taxonomy_Mappings
An adversary disables the network route between two targets. The goal is to completely sever the communications channel between two entities. This is often the result of a major error or the use of an "Internet kill switch" by those in control of critical infrastructure. This attack pattern differs from most other obstruction patterns by targeting the route itself, as opposed to the data passed over the route.
Low
High

The adversary requires knowledge of and access to network route.

Availability
Other
Disabling a network route denies the availability of a service.

Seamus Tuohy
2017-02-14

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns
In this attack pattern, an adversary physically disables networking hardware by powering it down or disconnecting critical equipment. Disabling or shutting off critical system resources prevents them from performing their service as intended, which can have direct and indirect consequences on other systems. This attack pattern is considerably less technical than the selective blocking used in most obstruction attacks.

The adversary requires physical access to the targeted communications equipment (networking devices, cables, etc.), which may be spread over a wide area.

Availability
Other
Denial of Service

Ensure rigorous physical defensive measures to keep the adversary from accessing critical systems..

Seamus Tuohy
2017-01-12

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns
An adversary suppresses the Border Gateway Protocol (BGP) advertisement for a route so as to render the underlying network inaccessible. The BGP protocol helps traffic move throughout the Internet by selecting the most efficient route between Autonomous Systems (AS), or routing domains. BGP is the basis for interdomain routing infrastructure, providing connections between these ASs. By suppressing the intended AS routing advertisements and/or forcing less effective routes for traffic to ASs, the adversary can deny availability for the target network.

The adversary must have control of a router that can modify, drop, or introduce spoofed BGP updates.The adversary can convince

BGP Router

Availability
Other
Disabling a network route at the routing infrastructure level denies availability of that route.

Implement Ingress filters to check the validity of received routes. However, this relies on the accuracy of Internet Routing Registries (IRRs) databases which are often not well-maintained.
Implement Secure BGP (S-BGP protocol), which improves authorization and authentication capabilities based on public-key cryptography.

Blackholing: The adversary intentionally references false routing advertisements in order to attract traffic to a particular router so it can be dropped.

Seamus Tuohy
2017-01-12

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations
In this attack pattern, an adversary influences a target's web-hosting company to disable a target domain. The goal is to prevent access to the targeted service provided by that domain. It usually occurs as the result of civil or criminal legal interventions.

This attack pattern requires that the adversary has cooperation from the registrar of the target domain.

Availability
Other
Disabling a target domain at the infrastructure level denies the availability of its service to the user.

The FBI's seizure of gambling websites, the US DOJ's seizure of child pornography websites, and Microsoft's seizure of all domains owned by the company No-IP in order to disrupt a cyberattack originating from a subset of those domains.

Seamus Tuohy
2017-01-12

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Description
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
Medium
High

The target application must unserialize data before validation.

Availability
Resource Consumption
If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate and exhaust available resources.

Integrity
Modify Data
Attackers can modify objects or data that was assumed to be safe from modification.

Authorization
Execute Unauthorized Commands
Functions that assume information in the deserialized object is valid could be exploited.

Implementation: Validate object before deserialization process

Design: Limit which types can be deserialized.

Implementation: Avoid having unnecessary types or gadgets available that can be leveraged for malicious ends. Use an allowlist of acceptable classes.

Implementation: Keep session state on the server, when possible.

CAPEC Content Team
The MITRE Corporation
2017-02-06

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations
This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.
High

The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains.

Confidentiality
Read Data
Cross Frame Scripting allows an adversary to steal sensitive data from a legitimate site.

Avoid clicking on untrusted links.
Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.

An adversary-controlled webpage contains malicious Javascript and a concealed iframe containing a legitimate website login (i.e., the concealed iframe would make it appear as though the actual legitimate website was loaded). When the user interacts with the legitimate website in the iframe, the malicious Javascript collects that sensitive information.

Cross Frame Scripting

CAPEC Content Team
The MITRE Corporation
2017-02-01

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated @Abstraction, Mitigations, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Example_Instances, Related_Attack_Patterns, Related_Weaknesses