deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-627: Counterfeit GPS Signals

Description:
An adversary attempts to deceive a GPS receiver by broadcasting counterfeit GPS signals, structured to resemble a set of normal GPS signals. These spoofed signals may be structured in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the adversary.
MITRE CAPEC-628: Carry-Off GPS Attack

Description:
A common form of a GPS spoofing attack, commonly termed a carry-off attack begins with an adversary broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gradually increased and drawn away from the genuine signals. Over time, the adversary can carry the target away from their intended destination and toward a location chosen by the adversary.
MITRE CAPEC-63: Cross-Site Scripting (XSS)

Description:
An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.

Mitigations:
  - Design: Use browser technologies that do not allow client side scripting.
  - Design: Utilize strict type, character, and encoding enforcement
  - Design: Server side developers should not proxy content via XHR or other means, if a http proxy for remote content is setup on the server side, the client's browser has no way of discerning where the 

Related CWEs: 79, 20
MITRE CAPEC-630: TypoSquatting

Description:
An adversary registers a domain name with at least one character different than a trusted domain. A TypoSquatting attack takes advantage of instances where a user mistypes a URL (e.g. www.goggle.com) or not does visually verify a URL before clicking on it (e.g. phishing attack). As a result, the user is directed to an adversary-controlled destination. TypoSquatting does not require an attack against the trusted domain or complicated reverse engineering.

Mitigations:
  - Authenticate all servers and perform redundant checks when using DNS hostnames.
  - Purchase potential TypoSquatted domains and forward to legitimate domain.
MITRE CAPEC-631: SoundSquatting

Description:
An adversary registers a domain name that sounds the same as a trusted domain, but has a different spelling. A SoundSquatting attack takes advantage of a user's confusion of the two words to direct Internet traffic to adversary-controlled destinations. SoundSquatting does not require an attack against the trusted domain or complicated reverse engineering.

Mitigations:
  - Authenticate all servers and perform redundant checks when using DNS hostnames.
  - Purchase potential SoundSquatted domains and forward to legitimate domain.
MITRE CAPEC-632: Homograph Attack via Homoglyphs

Description:
An adversary registers a domain name containing a homoglyph, leading the registered domain to appear the same as a trusted domain. A homograph attack leverages the fact that different characters among various character sets look the same to the user. Homograph attacks must generally be combined with other attacks, such as phishing attacks, in order to direct Internet traffic to the adversary-controlled destinations.

Mitigations:
  - Authenticate all servers and perform redundant checks when using DNS hostnames.
  - Utilize browsers that can warn users if URLs contain characters from different character sets.

Related CWEs: 1007
MITRE CAPEC-633: Token Impersonation

Description:
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.

Related CWEs: 287, 1270
MITRE CAPEC-634: Probe Audio and Video Peripherals

Description:
The adversary exploits the target system's audio and video functionalities through malware or scheduled tasks. The goal is to capture sensitive information about the target for financial, personal, political, or other gains which is accomplished by collecting communication data between two parties via the use of peripheral devices (e.g. microphones and webcams) or applications with audio and video capabilities (e.g. Skype) on a system.

Mitigations:
  - Prevent unknown code from executing on a system through the use of an allowlist policy.
  - Patch installed applications as soon as new updates become available.

Related CWEs: 267
MITRE CAPEC-635: Alternative Execution Due to Deceptive Filenames

Description:
The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.

Mitigations:
  - Applications should insure that the content of the file is consistent with format it is expecting, and not depend solely on the file extension.

Related CWEs: 162
MITRE CAPEC-636: Hiding Malicious Data or Code within Files

Description:
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.

Mitigations:
  - Many tools are available to search for the hidden data. Scan regularly for such data using one of these tools.

Related CWEs: 506
MITRE CAPEC-637: Collect Data from Clipboard

Description:
The adversary exploits an application that allows for the copying of sensitive data or information by collecting information copied to the clipboard. Data copied to the clipboard can be accessed by other applications, such as malware built to exfiltrate or log clipboard contents on a periodic basis. In this way, the adversary aims to garner information to which they are unauthorized.

Mitigations:
  - While copying and pasting of data with the clipboard is a legitimate and practical function, certain situations and context may require the disabling of this feature. Just as certain applications disa
  - Employ a robust identification and audit/blocking via using an allowlist of applications on your system. Malware may contain the functionality associated with this attack pattern.

Related CWEs: 267
MITRE CAPEC-638: Altered Component Firmware

Description:
An adversary exploits systems features and/or improperly protected firmware of hardware components, such as Hard Disk Drives (HDD), with the goal of executing malicious code from within the component's Master Boot Record (MBR). Conducting this type of attack entails the adversary infecting the target with firmware altering malware, using known tools, and a payload. Once this malware is executed, the MBR is modified to include instructions to execute the payload at desired intervals and when the system is booted up. A successful attack will obtain persistence within the victim system even if the operating system is reinstalled and/or if the component is formatted or has its data erased.

Mitigations:
  - Leverage hardware components known to not be susceptible to these types of attacks.
  - Implement hardware RAID infrastructure.
MITRE CAPEC-639: Probe System Files

Description:
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.

Mitigations:
  - Verify that files have proper access controls set, and reduce the storage of sensitive information to only what is necessary.

Related CWEs: 552
MITRE CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic

Description:
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.

Mitigations:
  - Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should 
  - Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding.
  - When client input is required from web-based forms, avoid using the "GET" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use th

Related CWEs: 177, 173, 172, 73, 22, 74, 20, 697, 707
MITRE CAPEC-640: Inclusion of Code in Existing Process

Description:
The adversary takes advantage of a bug in an application failing to verify the integrity of the running process to execute arbitrary code in the address space of a separate live process. The adversary could use running code in the context of another process to try to access process's memory, system/network resources, etc. The goal of this attack is to evade detection defenses and escalate privileges by masking the malicious code under an existing legitimate process. Examples of approaches include but not limited to: dynamic-link library (DLL) injection, portable executable injection, thread execution hijacking, ptrace system calls, VDSO hijacking, function hooking, reflective code loading, and more.

Mitigations:
  - Prevent unknown or malicious software from loading through using an allowlist policy.
  - Properly restrict the location of the software being used.
  - Leverage security kernel modules providing advanced access control and process restrictions like SELinux.

Related CWEs: 114, 829
MITRE CAPEC-641: DLL Side-Loading

Description:
An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.

Mitigations:
  - Prevent unknown DLLs from loading through using an allowlist policy.
  - Patch installed applications as soon as new updates become available.
  - Properly restrict the location of the software being used.

Related CWEs: 706
MITRE CAPEC-642: Replace Binaries

Description:
Adversaries know that certain binaries will be regularly executed as part of normal processing. If these binaries are not protected with the appropriate file system permissions, it could be possible to replace them with malware. This malware might be executed at higher system permission levels. A variation of this pattern is to discover self-extracting installation packages that unpack binaries to directories with weak file permissions which it does not clean up appropriately. These binaries can be replaced by malware, which can then be executed.

Mitigations:
  - Insure that binaries commonly used by the system have the correct file permissions. Set operating system policies that restrict privilege elevation of non-Administrators. Use auditing tools to observe

Related CWEs: 732
MITRE CAPEC-643: Identify Shared Files/Directories on System

Description:
An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.

Mitigations:
  - Identify unnecessary system utilities or potentially malicious software that may contain functionality to identify network share information, and audit and/or block them by using allowlist tools.

Related CWEs: 267, 200
MITRE CAPEC-644: Use of Captured Hashes (Pass The Hash)

Description:
An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.

Mitigations:
  - Prevent the use of Lan Man and NT Lan Man authentication on severs and apply patch KB2871997 to Windows 7 and higher systems.
  - Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.
  - Monitor system and domain logs for abnormal credential access.

Related CWEs: 522, 836, 308, 294, 308
MITRE CAPEC-645: Use of Captured Tickets (Pass The Ticket)

Description:
An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. An adversary can obtain any one of these tickets (e.g. Service Ticket, Ticket Granting Ticket, Silver Ticket, or Golden Ticket) to authenticate to a system/resource without needing the account's credentials. Depending on the ticket obtained, the adversary may be able to access a particular resource or generate TGTs for any account within an Active Directory Domain.

Mitigations:
  - Reset the built-in KRBTGT account password twice to invalidate the existence of any current Golden Tickets and any tickets derived from them.
  - Monitor system and domain logs for abnormal access.

Related CWEs: 522, 294, 308
MITRE CAPEC-646: Peripheral Footprinting

Description:
Adversaries may attempt to obtain information about attached peripheral devices and components connected to a computer system. Examples may include discovering the presence of iOS devices by searching for backups, analyzing the Windows registry to determine what USB devices have been connected, or infecting a victim system with malware to report when a USB device has been connected. This may allow the adversary to gain additional insight about the system or network environment, which may be useful in constructing further attacks.

Mitigations:
  - Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

Related CWEs: 200
MITRE CAPEC-647: Collect Data from Registries

Description:
An adversary exploits a weakness in authorization to gather system-specific data and sensitive information within a registry (e.g., Windows Registry, Mac plist). These contain information about the system configuration, software, operating system, and security. The adversary can leverage information gathered in order to carry out further attacks.

Mitigations:
  - Employ a robust and layered defensive posture in order to prevent unauthorized users on your system.
  - Employ robust identification and audit/blocking via using an allowlist of applications on your system. Unnecessary applications, utilities, and configurations will have a presence in the system regist

Related CWEs: 285
MITRE CAPEC-648: Collect Data from Screen Capture

Description:
An adversary gathers sensitive information by exploiting the system's screen capture functionality. Through screenshots, the adversary aims to see what happens on the screen over the course of an operation. The adversary can leverage information gathered in order to carry out further attacks.

Mitigations:
  - Identify potentially malicious software that may have functionality to acquire screen captures, and audit and/or block it by using allowlist tools.
  - While screen capture is a legitimate and practical function, certain situations and context may require the disabling of this feature.

Related CWEs: 267
MITRE CAPEC-649: Adding a Space to a File Extension

Description:
An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.

Mitigations:
  - File extensions should be checked to see if non-visible characters are being included.

Related CWEs: 46
MITRE CAPEC-65: Sniff Application Code

Description:
An adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.

Mitigations:
  - Design: Encrypt all communication between the client and server.
  - Implementation: Use SSL, SSH, SCP.
  - Operation: Use "ifconfig/ipconfig" or other tools to detect the sniffer installed in the network.

Related CWEs: 319, 311, 318, 693
MITRE CAPEC-650: Upload a Web Shell to a Web Server

Description:
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.

Mitigations:
  - Make sure your web server is up-to-date with all patches to protect against known vulnerabilities.
  - Ensure that the file permissions in directories on the web server from which files can be execute is set to the "least privilege" settings, and that those directories contents is controlled by an allo

Related CWEs: 287, 553
MITRE CAPEC-651: Eavesdropping

Description:
An adversary intercepts a form of communication (e.g. text, audio, video) by way of software (e.g., microphone and audio recording application), hardware (e.g., recording equipment), or physical means (e.g., physical proximity). The goal of eavesdropping is typically to gain unauthorized access to sensitive information about the target for financial, personal, political, or other gains. Eavesdropping is different from a sniffing attack as it does not take place on a network-based communication channel (e.g., IP traffic). Instead, it entails listening in on the raw audio source of a conversation between two or more parties.

Mitigations:
  - Be mindful of your surroundings when discussing sensitive information in public areas.
  - Implement proper software restriction policies to only allow authorized software on your environment. Use of anti-virus and other security monitoring and detecting tools can aid in this too. Closely m
  - If possible, physically disable the microphone on your machine if it is not needed.

Related CWEs: 200
MITRE CAPEC-652: Use of Known Kerberos Credentials

Description:
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.

Mitigations:
  - Create a strong password policy and ensure that your system enforces this policy for Kerberos service accounts.
  - Ensure Kerberos service accounts are not reusing username/password combinations for multiple systems, applications, or services.
  - Do not reuse Kerberos service account credentials across systems.

Related CWEs: 522, 307, 308, 309, 262, 263, 654, 294, 836
MITRE CAPEC-653: Use of Known Operating System Credentials

Description:
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.

Mitigations:
  - Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the network.
  - Create a strong password policy and ensure that your system enforces this policy.
  - Ensure users are not reusing username/password combinations for multiple systems, applications, or services.

Related CWEs: 522, 307, 308, 309, 262, 263, 654
MITRE CAPEC-654: Credential Prompt Impersonation

Description:
An adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.

Mitigations:
  - The only known mitigation to this attack is to avoid installing the malicious application on the device. However, to impersonate a running task the malicious application does need the GET_TASKS permis

Related CWEs: 1021
MITRE CAPEC-655: Avoid Security Tool Identification by Adding Data

Description:
An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions. 
             In addition to this, adding data to a file also changes the file's hash, frustrating security tools that look for known bad files by their hash.
MITRE CAPEC-656: Voice Phishing

Description:
An adversary targets users with a phishing attack for the purpose of soliciting account passwords or sensitive information from the user. Voice Phishing is a variation of the Phishing social engineering technique where the attack is initiated via a voice call, rather than email. The user is enticed to provide sensitive information by the adversary, who masquerades as a legitimate employee of the alleged organization. Voice Phishing attacks deviate from standard Phishing attacks, in that a user doesn't typically interact with a compromised website to provide sensitive information and instead provides this information verbally. Voice Phishing attacks can also be initiated by either the adversary in the form of a "cold call" or by the victim if calling an illegitimate telephone number.

Mitigations:
  - Do not accept calls from unknown numbers or from numbers that may be flagged as spam. Also, do not call numbers that appear on-screen after being unexpectedly redirected to potentially malicious websi