auren-research/cyber-sec huggingface dataset:
This attack pattern has been deprecated as it is a duplicate of the existing attack pattern "CAPEC-65 : Sniff Application Code". Please refer to this other CAPEC going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Architectural_Paradigms, Attack_Motivation-Consequences, Attack_Phases, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, CIA_Impact, Description, Description Summary, Examples-Instances, Frameworks, Languages, Methods_of_Attack, Platforms, Purposes, Related_Attack_Patterns, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Technical_Context, Typical_Likelihood_of_Exploit, Typical_Severity

Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Initial Distribution
This describes an attack where an application is forced to use a file that an attacker has corrupted. The result is often a denial of service caused by the application being unable to process the corrupted file, but other results, including the disabling of filters or access controls (if the application fails in an unsafe way rather than failing by locking down) or buffer overflows are possible.
Medium

The targeted application must utilize a configuration file that an attacker is able to corrupt. In some cases, the attacker must be able to force the (re-)reading of the corrupted file if the file is normally only consulted at startup.
The severity of the attack hinges on how the application responds to the corrupted file. If the application detects the corruption and locks down, this may result in the denial of services provided by the application. If the application fails to detect the corruption, the result could be a more severe denial of service (crash or hang) or even an exploitable buffer overflow. If the application detects the corruption but fails in an unsafe way, this attack could result in the continuation of services but without certain security structures, such as filters or access controls. For example, if the corrupted file configures filters, an unsafe response from an application could result in simply disabling the filtering mechanisms due to the lack of usable configuration data.

This varies depending on the resources necessary to corrupt the configuration file and the resources needed to force the application to re-read it (if any).

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses
This attack pattern has been deprecated as it is a duplicate of the existing attack pattern "CAPEC-13 : Subverting Environment Variable Values". Please refer to this other CAPEC going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Prerequisites, Description Summary, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations

Environment Variable Manipulation
This attack pattern has been deprecated as it is a duplicate of the existing attack pattern "CAPEC-77 : Manipulating User-Controlled Variables". Please refer to this other CAPEC going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Prerequisites, Description Summary, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations

Global variable manipulation
The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.

The target host is logging the action and data of the user.
The target host insufficiently protects access to the logs or logging mechanisms.

The attacker must understand how the logging mechanism works.
Optionally, the attacker must know the location and the format of individual entries of the log files.

1070
Indicator Removal on Host

1562.002
Impair Defenses: Disable Windows Event Logging

1562.003
Impair Defenses: Impair Command History Logging

1562.008
Impair Defenses: Disable Cloud Logs

Log Injection

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns, Taxonomy_Mappings
An adversary adds a new entry to the "run keys" in the Windows registry so that an application of their choosing is executed when a user logs in. In this way, the adversary can get their executable to operate and run on the target system with the authorized user's level of permissions. This attack is a good way for an adversary to run persistent spyware on a user's machine, such as a keylogger.
Medium
Medium

1
Explore
[Determine target system] The adversary must first determine the system they wish to target. This attack only works on Windows.

2
Experiment
[Gain access to the system] The adversary needs to gain access to the system in some way so that they can modify the Windows registry.
Gain physical access to a system either through shoulder surfing a password or accessing a system that is left unlocked.
Gain remote access to a system through a variety of means.

3
Exploit
[Modify Windows registry] The adversary will modify the Windows registry by adding a new entry to the "run keys" referencing a desired program. This program will be run whenever the user logs in.

The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.

Integrity
Modify Data
Gain Privileges

Identify programs that may be used to acquire process information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

An adversary can place a malicious executable (RAT) on the target system and then configure it to automatically run when the user logs in to maintain persistence on the target system.
Through the modification of registry "run keys" the adversary can masquerade a malicious executable as a legitimate program.

1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Start Folder

1547.014
Boot or Logon Autostart Execution: Active

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated References

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Examples-Instances, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description, Mitigations, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Description, Execution_Flow, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary subverts a communications protocol to perform an attack. This type of attack can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabilities in the protocol itself.
Medium

The protocol or implementations thereof must contain bugs that an adversary can exploit.

In some variants of this attack the adversary must be able to intercept communications using the protocol. This means they need to be able to receive the communications from one participant and prevent the other participant from receiving these communications.

CAPEC Content Team
The MITRE Corporation
2014-06-23
An attacker modifies the HTTP Verb (e.g. GET, PUT, TRACE, etc.) in order to bypass access restrictions. Some web environments allow administrators to restrict access based on the HTTP Verb used with requests. However, attackers can often provide a different HTTP Verb, or even provide a random string as a verb in order to bypass these protections. This allows the attacker to access data that should otherwise be protected.
Medium

The targeted system must attempt to filter access based on the HTTP verb used in requests.

The attacker requires a tool that allows them to manually control the HTTP verb used to send messages to the targeted server.

Design: Ensure that only legitimate HTTP verbs are allowed.
Design: Do not use HTTP verbs as factors in access decisions.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns
Inter-component protocols are used to communicate between different software and hardware modules within a single computer. Common examples are: interrupt signals and data pipes. Subverting the protocol can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabilities in the protocol itself.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary, Related_Weaknesses
Data Interchange Protocols are used to transmit structured data between entities. These protocols are often specific to a particular domain (B2B: purchase orders, invoices, transport logistics and waybills, medical records). They are often, but not always, XML-based. Subverting the protocol can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabilities in the protocol itself.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses
An adversary manipulates a web service related protocol to cause a web application or service to react differently than intended. This can either be performed through the manipulation of call parameters to include unexpected values, or by changing the called function to one that should normally be restricted or limited. By leveraging this pattern of attack, the adversary is able to gain access to data or resources normally restricted, or to cause the application or service to crash.

The targeted application or service must rely on web service protocols in such a way that malicious manipulation of them can alter functionality.

The attacker must be able to manipulate the communications to the targeted application or service.

Design: Range, size and value and consistency verification for any arguments supplied to applications and services from external sources and devise appropriate error response.
Design: Ensure that function calls that should not be called by an unprivileged user are not accessible to them.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Prerequisites, Description Summary, Resources_Required, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses
Simple Object Access Protocol (SOAP) is used as a communication protocol between a client and server to invoke web services on the server. It is an XML-based protocol, and therefore suffers from many of the same shortcomings as other XML-based protocols. Adversaries can make use of these shortcomings and manipulate the content of SOAP paramters, leading to undesirable behavior on the server and allowing the adversary to carry out a number of further attacks.
Medium
High

1
Exploit
[Find target application] The adversary needs to identify an application that uses SOAP as a communication protocol.
Observe HTTP traffic to an application and look for SOAP headers.

2
Experiment
[Detect Incorrect SOAP Parameter Handling] The adversary tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application.
Send more data than would seem reasonable for a field and see if the server complains.
Send nonsense data in a field that expects a certain subset, such as product names or sequence numbers, and see if the server complains.
Send XML metacharacters as data and see how the server responds.

3
Exploit
[Manipulate SOAP parameters] The adversary manipulates SOAP parameters in a way that causes undesirable behavior for the server. This can result in denial of service, information disclosure, arbitrary code exection, and more.
Create a recursive XML payload that will take up all of the memory on the server when parsed, resulting in a denial of service. This is known as the billion laughs attack.
Insert XML metacharacters into data fields that could cause the server to go into an error state when parsing. This could lead to a denial of service.
Insert a large amount of data into a field that should have a character limit, causing a buffer overflow.

An application uses SOAP-based web service api.
An application does not perform sufficient input validation to ensure that user-controllable data is safe for an XML parser.
The targeted server either fails to verify that data in SOAP messages conforms to the appropriate XML schema, or it fails to correctly handle the complete range of data allowed by the schema.

Availability
Resource Consumption

Confidentiality
Read Data

Confidentiality
Integrity
Availability
Execute Unauthorized Commands

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description, Description Summary, Examples-Instances, References, Related_Weaknesses, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Description, Example_Instances, Execution_Flow

Soap Manipulation
This attack pattern has been deprecated as its contents have been included in CAPEC-279 : SOAP Manipulation. Please refer to this other pattern going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Prerequisites, Description Summary, References, Related_Attack_Patterns, Resources_Required, Typical_Severity

SOAP Parameter Tampering
An adversary sends out an ICMP Type 8 Echo Request, commonly known as a 'Ping', in order to determine if a target system is responsive. If the request is not blocked by a firewall or ACL, the target host will respond with an ICMP Type 0 Echo Reply datagram. This type of exchange is usually referred to as a 'Ping' due to the Ping utility present in almost all operating systems. Ping, as commonly implemented, allows a user to test for alive hosts, measure round-trip time, and measure the percentage of packet loss.

Performing this operation for a range of hosts on the network is known as a 'Ping Sweep'. While the Ping utility is useful for small-scale host discovery, it was not designed for rapid or efficient host discovery over large network blocks. Other scanning utilities have been created that make ICMP ping sweeps easier to perform. Most networks filter ingress ICMP Type 8 messages for security reasons. Various other methods of performing ping sweeps have developed as a result. It is important to recognize the key security goal of the adversary is to discover if an IP address is alive, or has a responsive host. To this end, virtually any type of ICMP message, as defined by RFC 792 is useful. An adversary can cycle through various types of ICMP messages to determine if holes exist in the firewall configuration. When ICMP ping sweeps fail to discover hosts, other protocols can be used for the same purpose, such as TCP SYN or ACK segments, UDP datagrams sent to closed ports, etc.

Medium
Low

The ability to send an ICMP type 8 query (Echo Request) to a remote target and receive an ICMP type 0 message (ICMP Echo Reply) in response. Any firewalls or access control lists between the sender and receiver must allow ICMP Type 8 and ICMP Type 0 messages in order for a ping operation to succeed.

The adversary needs to know certain linux commands for this type of attack.

Scanners or utilities that provide the ability to send custom ICMP queries.

Confidentiality
Other
A successful attack of this kind can identify open ports and available services on a system.

Consider configuring firewall rules to block ICMP Echo requests and prevent replies. If not practical, monitor and consider action when a system has fast and a repeated pattern of requests that move incrementally through port numbers.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Description Summary, Resources_Required

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attacker_Skills_or_Knowledge_Required, Description, Description Summary, Related_Weaknesses, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An adversary uses a SYN scan to determine the status of ports on the remote target. SYN scanning is the most common type of port scanning that is used because of its many advantages and few drawbacks. As a result, novice attackers tend to overly rely on the SYN scan while performing system reconnaissance. As a scanning method, the primary advantages of SYN scanning are its universality and speed.

RFC 793 defines the required behavior of any TCP/IP device in that an incoming connection request begins with a SYN packet, which in turn must be followed by a SYN/ACK packet from the receiving service. For this reason, like TCP Connect scanning, SYN scanning works against any TCP stack. Unlike TCP Connect scanning, it is possible to scan thousands of ports per second using this method. This type of scanning is usually referred to as 'half-open' scanning because it does not complete the three-way handshake. The scanning rate is extremely fast because no time is wasted completing the handshake or tearing down the connection. This technique allows an attacker to scan through stateful firewalls due to the common configuration that TCP SYN segments for a new connection will be allowed for almost any port. TCP SYN scanning can also immediately detect 3 of the 4 important types of port status: open, closed, and filtered.

Low

1
Experiment
An adversary sends SYN packets to ports they want to scan and checks the response without completing the TCP handshake.

2
Experiment
An adversary uses the response from the target to determine the port's state. The adversary can determine the state of a port based on the following responses. When a SYN is sent to an open port and unfiltered port, a SYN/ACK will be generated. When a SYN packet is sent to a closed port a RST is generated, indicating the port is closed. When SYN scanning to a particular port generates no response, or when the request triggers ICMP Type 3 unreachable errors, the port is filtered.

This scan type is not possible with some operating systems (Windows XP SP 2). On Linux and Unix systems it requires root privileges to use raw sockets.

The ability to send TCP SYN segments to a host during network reconnaissance via the use of a network mapper or scanner, or via raw socket programming in a scripting language. Packet injection tools are also useful for this purpose. Depending upon the method used it may be necessary to sniff the network in order to see the response.

Confidentiality
Other
A successful attack of this kind can identify open ports and available services on a system.

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Description, Description Summary, References, Related_Weaknesses, Resources_Required

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Description, Execution_Flow

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
This attack pattern has been deprecated as it was determined to be an unnecessary layer of abstraction. Please refer to the meta level pattern CAPEC-169 : going forward, or to any of its children patterns.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, References, Resources_Required, Target_Attack_Surface, Target_Attack_Surface_Localities, Target_Attack_Surface_Types, Targeted_OSI_Layers, Typical_Severity
An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS Zone Transfer is not possible.
Low

The adversary requires access to a DNS server that will return the MX records for a network.

A command-line utility or other application capable of sending requests to the DNS server is necessary.

Confidentiality
Other

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Prerequisites, Description Summary, Related_Weaknesses
An attacker exploits a DNS misconfiguration that permits a ZONE transfer. Some external DNS servers will return a list of IP address and valid hostnames. Under certain conditions, it may even be possible to obtain Zone data about the organization's internal network. When successful the attacker learns valuable information about the topology of the target organization, including information about particular servers, their role within the IT structure, and possibly information about the operating systems running upon the network. This is configuration dependent behavior so it may also be required to search out multiple DNS servers while attempting to find one with ZONE transfers allowed.
Low

Access to a DNS server that allows Zone transfers.

A client application capable of interacting with the DNS server or a command-line utility or web application that automates DNS interactions.

Confidentiality
Read Data

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Weaknesses