auren-research/cyber-sec huggingface dataset:
An attacker substitutes out a tested and approved hardware component for a maliciously-altered hardware component. This type of attack is carried out directly on the system, enabling the attacker to then cause disruption or additional compromise.
Low
High

Physical access to the system or the integration facility where hardware components are kept.

Able to develop and manufacture malicious system components that perform the same functions and processes as their non-malicious counterparts.

An attacker has access to an organization's warehouse of card readers being included as a part of an overall security system. By replacing a critical hardware component in the card reader, the attacker is able to alter the function of the card reader to allow an attacker-supplied card to bypass a security checkpoint. The card reader is placed in the warehouse, and later used in the victim's security system. The attacker is then able to go to the victim and use their own card and bypass a physical security checkpoint and gain access to the victim's location for further malicious activity.

1195.003
Supply Chain Compromise: Compromise Hardware Supply Chain

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Attack_Prerequisites, Description Summary, Examples-Instances, References, Related_Attack_Patterns, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

Hardware Component Substitution After Installation
An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.
Low
High

Advanced knowledge about the installed target system design.
Advanced knowledge about the download and update installation processes.
Access to the download and update system(s) used to deliver BIOS images.

Able to develop a malicious BIOS image with the original functionality as a normal BIOS image, but with added functionality that allows for later compromise and/or disruption.

Deploy strong code integrity policies to allow only authorized apps to run.
Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities.
Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and requiring multi-factor authentication for admins.
Require SSL for update channels and implement certificate transparency based verification.
Sign update packages and BIOS patches.
Use hardware security modules/trusted platform modules to verify authenticity using hardware-based cryptography.

An attacker compromises the download and update portion of a manufacturer's web presence, and develops a malicious BIOS that in addition to the normal functionality will also at a specific time of day disable the remote access subsystem's security checks. The malicious BIOS is put in place on the manufacturer's website, the victim location is sent an official-looking email informing the victim of the availability of a new BIOS with bug fixes and enhanced performance capabilities to entice the victim to install the new BIOS quickly. The malicious BIOS is downloaded and installed on the victim's system, which allows for additional compromise by the attacker.

1495
Firmware Corruption

1542.001
Pre-OS Boot:System Firmware

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated References, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References, Related_Attack_Patterns, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Mitigations, References

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

Altered BIOS Installed After Installation
An attacker introduces malicious code to the victim's system by altering the payload of a software update, allowing for additional compromise or site disruption at the victim location. These manual, or user-assisted attacks, vary from requiring the user to download and run an executable, to as streamlined as tricking the user to click a URL. Attacks which aim at penetrating a specific network infrastructure often rely upon secondary attack methods to achieve the desired impact. Spamming, for example, is a common method employed as an secondary attack vector. Thus the attacker has in their arsenal a choice of initial attack vectors ranging from traditional SMTP/POP/IMAP spamming and its varieties, to web-application mechanisms which commonly implement both chat and rich HTML messaging within the user interface.
Low
High

Advanced knowledge about the download and update installation processes.
Advanced knowledge about the deployed system and its various software subcomponents and processes.

Able to develop malicious code that can be used on the victim's system while maintaining normal functionality.

Only accept software updates from an official source.

An email campaign was initiated, targetting victims of a ransomware attack. The email claimed to be a patch to address the ransomware attack, but was instead an attachment that caused the Cobalt Strike tools to be installed, which enabled further attacks.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Examples-Instances, References, Related_Attack_Patterns, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Example_Instances, Mitigations, References

Malicious Software Update
An adversary introduces malicious hardware during an update or replacement procedure, allowing for additional compromise or site disruption at the victim location. After deployment, it is not uncommon for upgrades and replacements to occur involving hardware and various replaceable parts. These upgrades and replacements are intended to correct defects, provide additional features, and to replace broken or worn-out parts. However, by forcing or tricking the replacement of a good component with a defective or corrupted component, an adversary can leverage known defects to obtain a desired malicious impact.
Low
High

Able to develop and manufacture malicious hardware components that perform the same functions and processes as their non-malicious counterparts.

An adversary develops a malicious networking card that allows for normal function plus the addition of malicious functionality that is of benefit to the adversary. The adversary sends the victim an email stating that the existing networking card is faulty, and that the victim can order a replacement card free of charge. The victim orders the card, and the adversary sends the malicious networking card. The malicious networking card replaces the perfectly-functioning original networking card, and the adversary is able to take advantage of the additional malicious functionality to further compromise the victim's network.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Attack_Prerequisites, Description Summary, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary, Examples-Instances

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated References
An attacker maliciously alters hardware components that will be sold on the gray market, allowing for victim disruption and compromise when the victim needs replacement hardware components for systems where the parts are no longer in regular supply from original suppliers, or where the hardware components from the attacker seems to be a great benefit from a cost perspective.
Low
High

Physical access to a gray market reseller's hardware components supply, or the ability to appear as a gray market reseller to the victim's buyer.

Able to develop and manufacture malicious hardware components that perform the same functions and processes as their non-malicious counterparts.

Purchase only from authorized resellers.
Validate serial numbers from multiple sources

An attacker develops co-processor boards with malicious capabilities that are technically the same as a manufacturer's expensive upgrade to their flagship system. The victim has installed the manufacturer's base system without the expensive upgrade. The attacker contacts the victim and states they have the co-processor boards at a drastically-reduced price, falsely stating they were acquired from a bankruptcy liquidation of a company that had purchased them from the manufacturer. The victim after hearing the drastically reduced price decides to take advantage of the situation and purchases the upgrades from the attacker, and installs them. This allows the attacker to further compromise the victim.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Examples-Instances, Related_Attack_Patterns, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Mitigations
An adversary, leveraging the ability to manipulate components of primary support systems and tools within the development and production environments, inserts malicious software within the hardware and/or firmware development environment. The infiltration purpose is to alter developed hardware components in a system destined for deployment at the victim's organization, for the purpose of disruption or further compromise.
Low
High

The victim must use email or removable media from systems running the IDE (or systems adjacent to the IDE systems).
The victim must have a system running exploitable applications and/or a vulnerable configuration to allow for initial infiltration.
The adversary must have working knowledge of some if not all of the components involved in the IDE system as well as the infrastructure.

Intelligence about the manufacturer's operating environment and infrastructure.
Ability to develop, deploy, and maintain a stealth malicious backdoor program remotely in what is essentially a hostile environment.
Development skills to construct malicious attachments that can be used to exploit vulnerabilities in typical desktop applications or system configurations. The malicious attachments should be crafted well enough to bypass typical defensive systems (IDS, anti-virus, etc)

Verify software downloads and updates to ensure they have not been modified be adversaries
Leverage antivirus tools to detect known malware
Do not download software from untrusted sources
Educate designers, developers, engineers, etc. on social engineering attacks to avoid downloading malicious software via attacks such as phishing attacks

The adversary, knowing the manufacturer runs email on a system adjacent to the hardware development systems used for hardware and/or firmware design, sends a phishing email with a malicious attachment to the manufacturer. When viewed, the malicious attachment installs a backdoor that allows the adversary to remotely compromise the adjacent hardware development system from the manufacturer's workstation. The adversary is then able to exfiltrate and alter sensitive data on the hardware system, allowing for future compromise once the developed system is deployed at the victim location.

1195.003
Supply Chain Compromise: Compromise Hardware Supply Chain

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Example_Instances, Mitigations, Prerequisites, References

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An attacker with access to the development environment process of an application-specific integrated circuit (ASIC) for a victim system being developed or maintained after initial deployment can insert malicious functionality into the system for the purpose of disruption or further compromise.
Low
High

The attacker must have working knowledge of some if not all of the components involved in the target system as well as the infrastructure and development environment of the manufacturer.
Advanced knowledge about the ASIC installed within the target system.

Able to develop and manufacture malicious subroutines for an ASIC environment without degradation of existing functions and processes.

A hardware manufacturer periodically updates its ASIC with new features. The attacker, knowing the manufacturer runs email on a system adjacent to the hardware development systems used for ASIC design, sends a phishing email with a malicious attachment to the manufacturer. When viewed, the malicious attachment installs a backdoor that allows the attacker to remotely compromise the adjacent ASIC development system. The attacker is then able to exfiltrate and alter sensitive data on the ASIC system, allowing for future compromise once a new AISC is deployed at the victim location.

1195.003
Supply Chain Compromise: Compromise Hardware Supply Chain

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Low
High

1
Explore
[Identify target application] The adversary identifies a target application or program to perform the buffer overread on. Adversaries often look for applications that accept user input and that perform manual memory management.

2
Experiment
[Find attack vector] The adversary identifies an attack vector by looking for areas in the application where they can specify to read more data than is required.

3
Exploit
[Overread the buffer] The adversary provides input to the application that gets it to read past the bounds of a buffer, possibly revealing sensitive information that was not intended to be given to the adversary.

For this type of attack to be successful, a few prerequisites must be met. First, the targeted software must be written in a language that enables fine grained buffer control. (e.g., c, c++) Second, the targeted software must actually perform buffer operations and inadequately perform bounds-checking on those buffer operations. Finally, the adversary must have the capability to influence the input that guides these buffer operations.

Confidentiality
Read Data
By reading outside the boundary of the intended buffer, the adversary is potentially able to see any data that is stored on the disk. This could include secret keys, personal information, and sensitive files.

Availability
Unreliable Execution
Depending on the use of the target buffer, an application or system crash can be achieved.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Execution_Flow
An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.
Low

None

1592.002
Gather Victim Host Information: Software

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
An adversary develops targeted malware that takes advantage of a known vulnerability in an organizational information technology environment. The malware crafted for these attacks is based specifically on information gathered about the technology environment. Successfully executing the malware enables an adversary to achieve a wide variety of negative technical impacts.

Software being run on a system matches a file signature found in a malware database
A suspicious module is loaded that is not regularly loaded by a system
Software on a system is making calls to "GetProcAddress()" which is a commonly used function to implement dynamic API resolution

1587.001
Develop Capabilities: Malware

1027
Obfuscated Files or Information

Adversaries often utilize obfuscation techniques when developing malware with the purpose of either avoiding detection or prevent the target from reverse engineering and understanding a captured malware sample. Some of these techniques include, but are not limited to, binary padding, software packing, stripping symbols and strings from a payload, and utilizing dynamic API resolution.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Indicators, Notes, Taxonomy_Mappings
Adversary creates duplicates of legitimate websites. When users visit a counterfeit site, the site can gather information or upload malware.
High

None

1036.005
Masquerading: Match Legitimate Name or Location

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns, Taxonomy_Mappings
An adversary creates a false front organizations with the appearance of a legitimate supplier in the critical life cycle path that then injects corrupted/malicious information system components into the organizational supply chain.
High

None

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns
An adversary who is authorized or has the ability to search known system resources, does so with the intention of gathering useful information. System resources include files, memory, and other aspects of the target system. In this pattern of attack, the adversary does not necessarily know what they are going to find when they start pulling data. This is different than CAPEC-150 where the adversary knows what they are looking for due to the common location.

1005
Data from Local System

1555.001
Credentials from Password Stores:Keychain

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Description Summary, References

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Description Summary

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Weaknesses, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses

Probe Application Queries
An adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment. If a cloud provider fails to completely delete storage and data from former cloud tenants' systems/resources, once these resources are allocated to new, potentially malicious tenants, the latter can probe the provided resources for sensitive information still there.
Low
Medium

The cloud provider must not assuredly delete part or all of the sensitive data for which they are responsible.The adversary must have the ability to interact with the system.

The adversary requires the ability to traverse directory structure.

Confidentiality
Read Data
A successful attack that probes application memory will compromise the confidentiality of that data.

Cloud providers should completely delete data to render it irrecoverable and inaccessible from any layer and component of infrastructure resources.
Deletion of data should be completed promptly when requested.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, References, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated @Name

Probe Application Memory
An adversary conducts a physical attack a device or component, destroying it such that it no longer functions as intended.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns