auren-research/cyber-sec huggingface dataset:
An adversary contaminates organizational information systems (including devices and networks) by causing them to handle information of a classification/sensitivity for which they have not been authorized. When this happens, the contaminated information system, device, or network must be brought offline to investigate and mitigate the data spill, which denies availability of the system until the investigation is complete.
Contamination through email is a very common attack vector. Systems with email servers or personal work systems using email are susceptible to this attack simply by receiving an email that contains a classified document or information. A fake classified document could even be used that is mistaken as true classified material. This would still cause the system to be taken offline until the validity of the classified material is confirmed.

Data Spill
When information is handled by an information system of a classification/sensitivity for which the system has not been authorized to handle.

Low
High

The adversary needs to have real or fake classified/sensitive information to place on a system

Knowledge of classification levels of systems
The ability to obtain a classified document or information
The ability to fake a classified document

Availability
Resource Consumption
Denial of Service

Confidentiality
Read Data
Victims of the attack can be exposed to classified materials

Properly safeguard classified/sensitive data. This includes training cleared individuals to ensure they are handling and disposing of this data properly, as well as ensuring systems only handle information of the classification level they are designed for.
Design systems with redundancy in mind. This could mean creating backing servers that could be switched over to in the event that a server has to be taken down for investigation.
Have a planned and efficient response plan to limit the amount of time a system is offline while the contamination is investigated.

An insider threat was able to obtain a classified document. They have knowledge that a backend server which provides access to a website also runs a mail server. The adversary creates a throwaway email address and sends the classified document to the mail server. When an administrator checks the mail server they notice that it has processed an email with a classified document and the server has to be taken offline while they investigate the contamination. In the meantime, the website has to be taken down as well and access to the website is denied until the backend can be migrated to another server or the investigation is complete.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Alternate_Terms, Consequences, Description, Example_Instances, Extended_Description, Likelihood_Of_Attack, Mitigations, Prerequisites, References, Related_Attack_Patterns, Skills_Required, Typical_Severity
An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.
Medium
High

Knowledge of the target system's vulnerabilities that can be capitalized on with malicious code.The adversary must be able to place the malicious code on the target system.

The means by which the adversary intends to place the malicious code on the system dictates the tools required. For example, suppose the adversary wishes to leverage social engineering and convince a legitimate user to open a malicious file attached to a seemingly legitimate email. In this case, the adversary might require a tool capable of wrapping malicious code into an innocuous filetype (e.g., PDF, .doc, etc.)

Confidentiality
Integrity
Availability
Execute Unauthorized Commands
Run Arbitrary Code

Confidentiality
Integrity
Availability
Other
Depending on the type of code executed by the adversary, the consequences of this attack pattern can vary widely.

Employ robust cybersecurity training for all employees.
Implement system antivirus software that scans all attachments before opening them.
Regularly patch all software.
Execute all suspicious files in a sandbox environment.

BlueBorne refers to a set of nine vulnerabilities on different platforms (Linux, Windows, Android, iOS) that offer an adversary the ability to install and execute malicious code on a system if they were close in proximity to a Bluetooth enabled device. One vulnerability affecting iOS versions 7 through 9 allowed an attacker to overflow the Low Energy Audio Protocol since commands sent over this protocol are improperly validated and gain the elevated permissions of the Bluetooth stack. These vulnerabilities were a result of poor validation and were patched shortly after their exposure in 2017, but many non-updated devices remain vulnerable.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Methods_of_Attack, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Example_Instances
When an operating system starts, it also starts programs called services or daemons. Adversaries may install a new service which will be executed at startup (on a Windows system, by modifying the registry). The service name may be disguised by using a name from a related operating system or benign software. Services are usually run with elevated privileges.

Limit privileges of user accounts so new service creation can only be performed by authorized administrators.

1543
Create or Modify System Process

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated References

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.

Limit privileges of user accounts so service changes can only be performed by authorized administrators. Also monitor any service changes that may occur inadvertently.

1543
Create or Modify System Process

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary exploits a weakness in authentication to install malware that alters the functionality and information provide by targeted operating system API calls. Often referred to as rootkits, it is often used to hide the presence of programs, files, network connections, services, drivers, and other system components.
Medium
High

Prevent adversary access to privileged accounts necessary to install rootkits.

A rootkit may take the form of a hypervisor. A hypervisor is a software layer that sits between the operating system and the processor. It presents a virtual running environment to the operating system. An example of a common hypervisor is Xen. Because a hypervisor operates at a level below the operating system it can hide its existence from the operating system.
Similar to a rootkit, a bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). Adversaries may use bootkits to persist on systems at a layer below the operating system, which may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

1014
Rootkit

1542.003
Pre-OS Boot:Bootkit

1547.006
Boot or Logon Autostart Execution:Kernel Modules and Extensions

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary, Examples-Instances, References, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings
An adversary attacks a system by bypassing some or all functionality intended to protect it. Often, a system user will think that protection is in place, but the functionality behind those protections has been disabled by the adversary.
Medium
High

CAPEC Content Team
The MITRE Corporation
2015-12-07

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses
This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.
Very High

Disable RDP, telnet, SSH and enable firewall rules to block such traffic. Limit users and accounts that have remote interactive login access. Remove the Local Administrators group from the list of groups allowed to login through RDP. Limit remote user permissions. Use remote desktop gateways and multifactor authentication for remote logins.

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). There are other implementations and third-party tools that provide graphical access Remote Services similar to RDS. Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.
Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell.

1021
Remote Services

1114.002
Email Collection:Remote Email Collection

1133
External Remote Services

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary, Examples-Instances, References, Related_Weaknesses, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated @Abstraction, Related_Attack_Patterns, Related_Weaknesses, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.

Inspect registry for changes. Limit privileges of user accounts so changes to default file handlers can only be performed by authorized administrators.

1546.001
Event Triggered Execution:Change Default File Association

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings
This CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary, References, Related_Attack_Patterns, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description

Schedule Software To Run
An adversary exploits weaknesses in privilege management or access control to replace a trusted executable with a malicious version and enable the execution of malware when that trusted executable is called.
Low
High

Specific versions of Windows contain accessibility features that may be launched with a key combination before a user has logged in (for example when they are on the Windows Logon screen). On Windows XP and Windows Server 2003/R2, the program (e.g. "C:\Windows\System32\utilman.exe") may be replaced with cmd.exe (or another program that provides backdoor access). Then pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over RDP will cause the replaced file to be executed with SYSTEM privileges.

1505.005
Server Software Component: Terminal Services DLL

1546.008
Event Triggered Execution: Accessibility Features

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary, References, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
In this attack pattern, the adversary sends disruptive signals at a target satellite using a rogue uplink station to disrupt the intended transmission. Those within the satellite's footprint are prevented from reaching the satellite's targeted or neighboring channels. The satellite's footprint size depends upon its position in the sky; higher orbital satellites cover multiple continents.
Low
High

This attack requires the knowledge of the satellite's coordinates for targeting.

A satellite uplink station.

Availability
Other
A successful attack will deny the availability of the satellite communications for authorized users.

Seamus Tuohy
2017-01-12
This attack pattern has been deprecated as it is a duplicate of CAPEC-207 : Removing Important Client Functionality. Please refer to this other pattern going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Architectural_Paradigms, Attack_Motivation-Consequences, Attack_Phases, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, CIA_Impact, Description, Description Summary, Examples-Instances, Frameworks, Injection_Vector, Languages, Payload, Payload_Activation_Impact, Platforms, Probing_Techniques, Purposes, Related_Attack_Patterns, Related_Guidelines, Related_Security_Principles, Related_Vulnerabilities, Related_Weaknesses, Resources_Required, Technical_Context, Typical_Likelihood_of_Exploit, Typical_Severity

Removing/short-circuiting 'guard logic'
An adversary manipulates the files in a shared location by adding malicious programs, scripts, or exploit code to valid content. Once a user opens the shared content, the tainted content is executed.

Disallow shared content. Protect shared folders by minimizing users that have write access. Use utilities that mitigate exploitation like the Microsoft Enhanced Mitigation Experience Toolkit (EMET) to prevent exploits from being run.

1080
Taint shared content

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses
An adversaries may add malicious content to a website through the open file share and then browse to that content with a web browser to cause the server to execute the content. The malicious content will typically run under the context and permissions of the web server process, often resulting in local system or administrative privileges depending on how the web server is configured.

Ensure proper permissions on directories that are accessible through a web server. Disallow remote access to the web root. Disable execution on directories within the web root. Ensure that permissions of the web server process are only what is required by not using built-in accounts and instead create specific accounts to limit unnecessary access or permissions overlap across multiple systems.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings
Operating system allows logon scripts to be run whenever a specific user or users logon to a system. If adversaries can access these scripts, they may insert additional code into the logon script. This code can allow them to maintain persistence or move laterally within an enclave because it is executed every time the affected user or users logon to a computer. Modifying logon scripts can effectively bypass workstation and enclave firewalls. Depending on the access configuration of the logon scripts, either local credentials or a remote administrative account may be necessary.

Restrict write access to logon scripts to necessary administrators.

1037
Boot or Logon Initialization Scripts

1543.001
Create or Modify System Process: Launch Agent

1543.004
Create or Modify System Process: Launch Daemon

1547
Boot or Logon Autostart Execution

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
This CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary, References, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description

Obtain Data via Utilities
An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.
High

1
Explore
[Determine which user's credentials to capture] Since this is a more targeted attack, an adversary will first identify a particular user they wish the capture the credentials of.

2
Experiment
[Deploy keylogger] Once a user is identified, an adversary will deploy a keylogger to the user's system in one of many ways.
Send a phishing email with a malicious attachment that installs a keylogger on a user's system
Conceal a keylogger behind fake software and get the user to download the software
Get a user to click on a malicious URL that directs them to a webpage that will install a keylogger without their knowledge
Gain access to the user's system through a vulnerability and manually install a keylogger

3
Experiment
[Record keystrokes] Once the keylogger is deployed on the user's system, the adversary will record keystrokes over a period of time.

4
Experiment
[Analyze data and determine credentials] Using the captured keystrokes, the adversary will be able to determine the credentials of the user.
Search for repeated sequences that are following by the enter key
Search for repeated sequences that are not found in a dictionary
Search for several backspaces in a row. This could indicate a mistyped password. The correct password can then be inferred using the whole key sequence

5
Exploit
[Use found credentials] After the adversary has found the credentials for the target user, they will then use them to gain access to a system in order to perform some follow-up attack

The ability to install the keylogger, either in person or remote.

Strong physical security can help reduce the ability of an adversary to install a keylogger.

1056.001
Input Capture:Keylogging

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Execution_Flow
An attacker leverages a tool, device, or program to obtain specific information as provided by a user of the target system. This information is often needed by the attacker to launch a follow-on attack. This attack is different than Social Engineering as the adversary is not tricking or deceiving the user. Instead the adversary is putting a mechanism in place that captures the information that a user legitimately enters into a system. Deploying a keylogger, performing a UAC prompt, or wrapping the Windows default credential provider are all examples of such interactions.

1056
Input Capture

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns, Taxonomy_Mappings
This CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary, References, Related_Attack_Patterns, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description

Signature-Based Avoidance
An adversary prevents host-generated logs being delivered to a central location in an attempt to hide indicators of compromise.

In the case of network based reporting of indicators, an adversary may block traffic associated with reporting to prevent central station analysis. This may be accomplished by many means such as stopping a local process to creating a host-based firewall rule to block traffic to a specific server.
In the case of local based reporting of indicators, an adversary may block delivery of locally-generated log files themselves to the central repository.

Low

1562.002
Impair Defenses: Disable Windows Event Logging

1562.002
Impair Defenses: Impair Command History Logging

1562.006
Impair Defenses: Indicator Blocking

1562.008
Impair Defenses: Disable Cloud Logs

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Description, Extended_Description, Taxonomy_Mappings