deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-55: Rainbow Table Password Cracking

Description:
An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system.

Mitigations:
  - Use salt when computing password hashes. That is, concatenate the salt (random bits) with the original password prior to hashing it.

Related CWEs: 261, 521, 262, 263, 654, 916, 308, 309
MITRE CAPEC-550: Install New Service

Description:
When an operating system starts, it also starts programs called services or daemons. Adversaries may install a new service which will be executed at startup (on a Windows system, by modifying the registry). The service name may be disguised by using a name from a related operating system or benign software. Services are usually run with elevated privileges.

Mitigations:
  - Limit privileges of user accounts so new service creation can only be performed by authorized administrators.

Related CWEs: 284
MITRE CAPEC-551: Modify Existing Service

Description:
When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.

Mitigations:
  - Limit privileges of user accounts so service changes can only be performed by authorized administrators. Also monitor any service changes that may occur inadvertently.

Related CWEs: 284, 522
MITRE CAPEC-552: Install Rootkit 

Description:
An adversary exploits a weakness in authentication to install malware that alters the functionality and information provide by targeted operating system API calls. Often referred to as rootkits, it is often used to hide the presence of programs, files, network connections, services, drivers, and other system components.

Mitigations:
  - Prevent adversary access to privileged accounts necessary to install rootkits.

Related CWEs: 284
MITRE CAPEC-554: Functionality Bypass

Description:
An adversary attacks a system by bypassing some or all functionality intended to protect it. Often, a system user will think that protection is in place, but the functionality behind those protections has been disabled by the adversary.

Related CWEs: 424, 1299
MITRE CAPEC-555: Remote Services with Stolen Credentials

Description:
This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.

Mitigations:
  - Disable RDP, telnet, SSH and enable firewall rules to block such traffic. Limit users and accounts that have remote interactive login access. Remove the Local Administrators group from the list of gro

Related CWEs: 522, 308, 309, 294, 263, 262, 521
MITRE CAPEC-556: Replace File Extension Handlers

Description:
When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.

Mitigations:
  - Inspect registry for changes. Limit privileges of user accounts so changes to default file handlers can only be performed by authorized administrators.

Related CWEs: 284
MITRE CAPEC-558: Replace Trusted Executable

Description:
An adversary exploits weaknesses in privilege management or access control to replace a trusted executable with a malicious version and enable the execution of malware when that trusted executable is called.

Related CWEs: 284
MITRE CAPEC-559: Orbital Jamming

Description:
In this attack pattern, the adversary sends disruptive signals at a target satellite using a rogue uplink station to disrupt the intended transmission. Those within the satellite's footprint are prevented from reaching the satellite's targeted or neighboring channels. The satellite's footprint size depends upon its position in the sky; higher orbital satellites cover multiple continents.
MITRE CAPEC-560: Use of Known Domain Credentials

Description:
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.

Mitigations:
  - Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.
  - Create a strong password policy and ensure that your system enforces this policy.
  - Ensure users are not reusing username/password combinations for multiple systems, applications, or services.

Related CWEs: 522, 307, 308, 309, 262, 263, 654, 1273
MITRE CAPEC-561: Windows Admin Shares with Stolen Credentials

Description:
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.

Mitigations:
  - Do not reuse local administrator account credentials across systems.
  - Deny remote use of local admin credentials to log into domain systems.
  - Do not allow accounts to be a local administrator on more than one system.

Related CWEs: 522, 308, 309, 294, 263, 262, 521
MITRE CAPEC-562: Modify Shared File

Description:
An adversary manipulates the files in a shared location by adding malicious programs, scripts, or exploit code to valid content. Once a user opens the shared content, the tainted content is executed.

Mitigations:
  - Disallow shared content. Protect shared folders by minimizing users that have write access. Use utilities that mitigate exploitation like the Microsoft Enhanced Mitigation Experience Toolkit (EMET) to

Related CWEs: 284
MITRE CAPEC-563: Add Malicious File to Shared Webroot

Description:
An adversaries may add malicious content to a website through the open file share and then browse to that content with a web browser to cause the server to execute the content. The malicious content will typically run under the context and permissions of the web server process, often resulting in local system or administrative privileges depending on how the web server is configured.

Mitigations:
  - Ensure proper permissions on directories that are accessible through a web server. Disallow remote access to the web root. Disable execution on directories within the web root. Ensure that permissions

Related CWEs: 284
MITRE CAPEC-564: Run Software at Logon

Description:
Operating system allows logon scripts to be run whenever a specific user or users logon to a system. If adversaries can access these scripts, they may insert additional code into the logon script. This code can allow them to maintain persistence or move laterally within an enclave because it is executed every time the affected user or users logon to a computer. Modifying logon scripts can effectively bypass workstation and enclave firewalls. Depending on the access configuration of the logon scripts, either local credentials or a remote administrative account may be necessary.

Mitigations:
  - Restrict write access to logon scripts to necessary administrators.

Related CWEs: 284
MITRE CAPEC-565: Password Spraying

Description:
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.

Mitigations:
  - Create a strong password policy and ensure that your system enforces this policy.
  - Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2.
  - Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.

Related CWEs: 521, 262, 263, 654, 307, 308, 309
MITRE CAPEC-568: Capture Credentials via Keylogger

Description:
An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.

Mitigations:
  - Strong physical security can help reduce the ability of an adversary to install a keylogger.
MITRE CAPEC-569: Collect Data as Provided by Users

Description:
An attacker leverages a tool, device, or program to obtain specific information as provided by a user of the target system. This information is often needed by the attacker to launch a follow-on attack. This attack is different than Social Engineering as the adversary is not tricking or deceiving the user. Instead the adversary is putting a mechanism in place that captures the information that a user legitimately enters into a system. Deploying a keylogger, performing a UAC prompt, or wrapping the Windows default credential provider are all examples of such interactions.
MITRE CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

Description:
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.

Mitigations:
  - Implementation: Implement message level security such as HMAC in the HTTP communication
  - Design: Utilize defense in depth, do not rely on a single security mechanism like SSL
  - Design: Enforce principle of least privilege

Related CWEs: 300, 287, 693
MITRE CAPEC-571: Block Logging to Central Repository

Description:
An adversary prevents host-generated logs being delivered to a central location in an attempt to hide indicators of compromise.
MITRE CAPEC-572: Artificially Inflate File Sizes

Description:
An adversary modifies file contents by adding data to files for several reasons. Many different attacks could “follow” this pattern resulting in numerous outcomes. Adding data to a file could also result in a Denial of Service condition for devices with limited storage capacity.
MITRE CAPEC-573: Process Footprinting

Description:
An adversary exploits functionality meant to identify information about the currently running processes on the target system to an authorized user. By knowing what processes are running on the target system, the adversary can learn about the target environment as a means towards further malicious behavior.

Mitigations:
  - Identify programs that may be used to acquire process information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

Related CWEs: 200
MITRE CAPEC-574: Services Footprinting

Description:
An adversary exploits functionality meant to identify information about the services on the target system to an authorized user. By knowing what services are registered on the target system, the adversary can learn about the target environment as a means towards further malicious behavior. Depending on the operating system, commands that can obtain services information include "sc" and "tasklist/svc" using Tasklist, and "net start" using Net.

Mitigations:
  - Identify programs that may be used to acquire service information and block them by using a software restriction policy or tools that restrict program execution by uaing a process allowlist.

Related CWEs: 200
MITRE CAPEC-575: Account Footprinting

Description:
An adversary exploits functionality meant to identify information about the domain accounts and their permissions on the target system to an authorized user. By knowing what accounts are registered on the target system, the adversary can inform further and more targeted malicious behavior. Example Windows commands which can acquire this information are: "net user" and "dsquery".

Mitigations:
  - Identify programs that may be used to acquire account information and block them by using a software restriction policy or tools that restrict program execution by uysing a process allowlist.

Related CWEs: 200
MITRE CAPEC-576: Group Permission Footprinting

Description:
An adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command which can list local groups is "net localgroup".

Mitigations:
  - Identify programs (such as "net") that may be used to enumerate local group permissions and block them by using a software restriction Policy or tools that restrict program execution by using a proces

Related CWEs: 200
MITRE CAPEC-577: Owner Footprinting

Description:
An adversary exploits functionality meant to identify information about the primary users on the target system to an authorized user. They may do this, for example, by reviewing logins or file modification times. By knowing what owners use the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command that may accomplish this is "dir /A ntuser.dat". Which will display the last modified time of a user's ntuser.dat file when run within the root folder of a user. This time is synonymous with the last time that user was logged in.

Mitigations:
  - Ensure that proper permissions on files and folders are enacted to limit accessibility.

Related CWEs: 200
MITRE CAPEC-578: Disable Security Software

Description:
An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.

Mitigations:
  - Ensure proper permissions are in place to prevent adversaries from altering the execution status of security tools.

Related CWEs: 284
MITRE CAPEC-579: Replace Winlogon Helper DLL

Description:
Winlogon is a part of Windows that performs logon actions. In Windows systems prior to Windows Vista, a registry key can be modified that causes Winlogon to load a DLL on startup. Adversaries may take advantage of this feature to load adversarial code at startup.

Mitigations:
  - Changes to registry entries in "HKLM\Software\Microsoft\Windows NT\Winlogon\Notify" that do not correlate with known software, patch cycles, etc are suspicious. New DLLs written to System32 which do n

Related CWEs: 15
MITRE CAPEC-58: Restful Privilege Elevation

Description:
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

Mitigations:
  - Design: Enforce principle of least privilege
  - Implementation: Ensure that HTTP Get methods only retrieve state and do not alter state on the server side
  - Implementation: Ensure that HTTP methods have proper ACLs based on what the functionality they expose

Related CWEs: 267, 269
MITRE CAPEC-580: System Footprinting

Description:
An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.

Mitigations:
  - Keep patches up to date by installing weekly or daily if possible.
  - Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

Related CWEs: 204, 205, 208
MITRE CAPEC-581: Security Software Footprinting

Description:
Adversaries may attempt to get a listing of security tools that are installed on the system and their configurations. This may include security related system features (such as a built-in firewall or anti-spyware) as well as third-party security software.

Mitigations:
  - Identify programs that may be used to acquire security tool information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
MITRE CAPEC-582: Route Disabling

Description:
An adversary disables the network route between two targets. The goal is to completely sever the communications channel between two entities. This is often the result of a major error or the use of an "Internet kill switch" by those in control of critical infrastructure. This attack pattern differs from most other obstruction patterns by targeting the route itself, as opposed to the data passed over the route.
MITRE CAPEC-583: Disabling Network Hardware

Description:
In this attack pattern, an adversary physically disables networking hardware by powering it down or disconnecting critical equipment. Disabling or shutting off critical system resources prevents them from performing their service as intended, which can have direct and indirect consequences on other systems. This attack pattern is considerably less technical than the selective blocking used in most obstruction attacks.

Mitigations:
  - Ensure rigorous physical defensive measures to keep the adversary from accessing critical systems..
MITRE CAPEC-584: BGP Route Disabling

Description:
An adversary suppresses the Border Gateway Protocol (BGP) advertisement for a route so as to render the underlying network inaccessible. The BGP protocol helps traffic move throughout the Internet by selecting the most efficient route between Autonomous Systems (AS), or routing domains. BGP is the basis for interdomain routing infrastructure, providing connections between these ASs. By suppressing the intended AS routing advertisements and/or forcing less effective routes for traffic to ASs, the adversary can deny availability for the target network.

Mitigations:
  - Implement Ingress filters to check the validity of received routes. However, this relies on the accuracy of Internet Routing Registries (IRRs) databases which are often not well-maintained.
  - Implement Secure BGP (S-BGP protocol), which improves authorization and authentication capabilities based on public-key cryptography.
MITRE CAPEC-585: DNS Domain Seizure

Description:
In this attack pattern, an adversary influences a target's web-hosting company to disable a target domain. The goal is to prevent access to the targeted service provided by that domain. It usually occurs as the result of civil or criminal legal interventions.
MITRE CAPEC-586: Object Injection

Description:
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.

Mitigations:
  - Implementation: Validate object before deserialization process
  - Design: Limit which types can be deserialized.
  - Implementation: Avoid having unnecessary types or gadgets available that can be leveraged for malicious ends. Use an allowlist of acceptable classes.

Related CWEs: 502
MITRE CAPEC-587: Cross Frame Scripting (XFS)

Description:
This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.

Mitigations:
  - Avoid clicking on untrusted links.
  - Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.

Related CWEs: 1021
MITRE CAPEC-588: DOM-Based XSS

Description:
This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is inserted into the client-side HTML being parsed by a web browser. Content served by a vulnerable web application includes script code used to manipulate the Document Object Model (DOM). This script code either does not properly validate input, or does not perform proper output encoding, thus creating an opportunity for an adversary to inject a malicious script launch a XSS attack. A key distinction between other XSS attacks and DOM-based attacks is that in other XSS attacks, the malicious script runs when the vulnerable web page is initially loaded, while a DOM-based attack executes sometime after the page loads. Another distinction of DOM-based attacks is that in some cases, the malicious script is never sent to the vulnerable web server at all. An attack like this is guaranteed to bypass any server-side filtering attempts to protect users.

Mitigations:
  - Use browser technologies that do not allow client-side scripting.
  - Utilize proper character encoding for all output produced within client-site scripts manipulating the DOM.
  - Ensure that all user-supplied input is validated before use.

Related CWEs: 79, 20, 83
MITRE CAPEC-589: DNS Blocking

Description:
An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.

Mitigations:
  - Hard Coded Alternate DNS server in applications
  - Avoid dependence on DNS
  - Include "hosts file"/IP address in the application.

Related CWEs: 300
MITRE CAPEC-59: Session Credential Falsification through Prediction

Description:
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Mitigations:
  - Use a strong source of randomness to generate a session ID.
  - Use adequate length session IDs
  - Do not use information available to the user in order to generate session ID (e.g., time).

Related CWEs: 290, 330, 331, 346, 488, 539, 200, 6, 285, 384
MITRE CAPEC-590: IP Address Blocking

Description:
An adversary performing this type of attack drops packets destined for a target IP address. The aim is to prevent access to the service hosted at the target IP address.

Mitigations:
  - Have a large pool of backup IPs built into the application and support proxy capability in the application.

Related CWEs: 300
MITRE CAPEC-591: Reflected XSS

Description:
This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is "reflected" off a vulnerable web application and then executed by a victim's browser. The process starts with an adversary delivering a malicious script to a victim and convincing the victim to send the script to the vulnerable web application.

Mitigations:
  - Use browser technologies that do not allow client-side scripting.
  - Utilize strict type, character, and encoding enforcement.
  - Ensure that all user-supplied input is validated before use.

Related CWEs: 79