deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-509: Kerberoasting

Description:
Through the exploitation of how service accounts leverage Kerberos authentication with Service Principal Names (SPNs), the adversary obtains and subsequently cracks the hashed credentials of a service account target to exploit its privileges. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. As an authenticated user, the adversary may request Active Directory and obtain a service ticket with portions encrypted via RC4 with the private key of the authenticated account. By extracting the local ticket and saving it disk, the adversary can brute force the hashed value to reveal the target account credentials.

Mitigations:
  - Monitor system and domain logs for abnormal access.
  - Employ a robust password policy for service accounts. Passwords should be of adequate length and complexity, and they should expire after a period of time.
  - Employ the principle of least privilege: limit service accounts privileges to what is required for functionality and no more.

Related CWEs: 522, 308, 309, 294, 263, 262, 521
MITRE CAPEC-51: Poison Web Service Registry

Description:
SOA and Web Services often use a registry to perform look up, get schema information, and metadata about services. A poisoned registry can redirect (think phishing for servers) the service requester to a malicious service provider, provide incorrect information in schema or metadata, and delete information about service provider interfaces.

Mitigations:
  - Design: Enforce principle of least privilege
  - Design: Harden registry server and file access permissions
  - Implementation: Implement communications to and from the registry using secure protocols

Related CWEs: 285, 74, 693
MITRE CAPEC-510: SaaS User Request Forgery

Description:
An adversary, through a previously installed malicious application, performs malicious actions against a third-party Software as a Service (SaaS) application (also known as a cloud based application) by leveraging the persistent and implicit trust placed on a trusted user's session. This attack is executed after a trusted user is authenticated into a cloud service, "piggy-backing" on the authenticated session, and exploiting the fact that the cloud service believes it is only interacting with the trusted user. If successful, the actions embedded in the malicious application will be processed and accepted by the targeted SaaS application and executed at the trusted user's privilege level.

Mitigations:
  - To limit one's exposure to this type of attack, tunnel communications through a secure proxy service.
  - Detection of this type of attack can be done through heuristic analysis of behavioral anomalies (a la credit card fraud detection) which can be used to identify inhuman behavioral patterns. (e.g., spi

Related CWEs: 346
MITRE CAPEC-511: Infiltration of Software Development Environment

Description:
An attacker uses common delivery mechanisms such as email attachments or removable media to infiltrate the IDE (Integrated Development Environment) of a victim manufacturer with the intent of implanting malware allowing for attack control of the victim IDE environment. The attack then uses this access to exfiltrate sensitive data or information, manipulate said data or information, and conceal these actions. This will allow and aid the attack to meet the goal of future compromise of a recipient of the victim's manufactured product further down in the supply chain.

Mitigations:
  - Avoid the common delivery mechanisms of adversaries, such as email attachments, which could introduce the malware.
MITRE CAPEC-516: Hardware Component Substitution During Baselining

Description:
An adversary with access to system components during allocated baseline development can substitute a maliciously altered hardware component for a baseline component during the product development and research phases. This can lead to adjustments and calibrations being made in the product so that when the final product, now containing the modified component, is deployed it will not perform as designed and be advantageous to the adversary.

Mitigations:
  - Hardware attacks are often difficult to detect, as inserted components can be difficult to identify or remain dormant for an extended period of time.
  - Acquire hardware and hardware components from trusted vendors. Additionally, determine where vendors purchase components or if any components are created/acquired via subcontractors to determine where
MITRE CAPEC-517: Documentation Alteration to Circumvent Dial-down

Description:
An attacker with access to a manufacturer's documentation, which include descriptions of advanced technology and/or specific components' criticality, alters the documents to circumvent dial-down functionality requirements. This alteration would change the interpretation of implementation and manufacturing techniques, allowing for advanced technologies to remain in place even though these technologies might be restricted to certain customers, such as nations on the terrorist watch list, giving the attacker on the receiving end of a shipped product access to an advanced technology that might otherwise be restricted.

Mitigations:
  - Digitize documents and cryptographically sign them to verify authenticity.
  - Password protect documents and make them read-only for unauthorized users.
  - Avoid emailing important documents and configurations.
MITRE CAPEC-518: Documentation Alteration to Produce Under-performing Systems

Description:
An attacker with access to a manufacturer's documentation alters the descriptions of system capabilities with the intent of causing errors in derived system requirements, impacting the overall effectiveness and capability of the system, allowing an attacker to take advantage of the introduced system capability flaw once the system is deployed.

Mitigations:
  - Digitize documents and cryptographically sign them to verify authenticity.
  - Password protect documents and make them read-only for unauthorized users.
  - Avoid emailing important documents and configurations.
MITRE CAPEC-519: Documentation Alteration to Cause Errors in System Design

Description:
An attacker with access to a manufacturer's documentation containing requirements allocation and software design processes maliciously alters the documentation in order to cause errors in system design. This allows the attacker to take advantage of a weakness in a deployed system of the manufacturer for malicious purposes.

Mitigations:
  - Digitize documents and cryptographically sign them to verify authenticity.
  - Password protect documents and make them read-only for unauthorized users.
  - Avoid emailing important documents and configurations.
MITRE CAPEC-52: Embedding NULL Bytes

Description:
An adversary embeds one or more null bytes in input to the target software. This attack relies on the usage of a null-valued byte as a string terminator in many environments. The goal is for certain components of the target software to stop processing the input when it encounters the null byte(s).

Mitigations:
  - Properly handle the NULL characters supplied as part of user input prior to doing anything with the data.

Related CWEs: 158, 172, 173, 74, 20, 697, 707
MITRE CAPEC-520: Counterfeit Hardware Component Inserted During Product Assembly

Description:
An adversary with either direct access to the product assembly process or to the supply of subcomponents used in the product assembly process introduces counterfeit hardware components into product assembly. The assembly containing the counterfeit components results in a system specifically designed for malicious purposes.

Mitigations:
  - Hardware attacks are often difficult to detect, as inserted components can be difficult to identify or remain dormant for an extended period of time.
  - Acquire hardware and hardware components from trusted vendors. Additionally, determine where vendors purchase components or if any components are created/acquired via subcontractors to determine where
MITRE CAPEC-521: Hardware Design Specifications Are Altered

Description:
An attacker with access to a manufacturer's hardware manufacturing process documentation alters the design specifications, which introduces flaws advantageous to the attacker once the system is deployed.

Mitigations:
  - Digitize documents and cryptographically sign them to verify authenticity.
  - Password protect documents and make them read-only for unauthorized users.
  - Avoid emailing important documents and configurations.
MITRE CAPEC-522: Malicious Hardware Component Replacement

Description:
An adversary replaces legitimate hardware in the system with faulty counterfeit or tampered hardware in the supply chain distribution channel, with purpose of causing malicious disruption or allowing for additional compromise when the system is deployed.

Mitigations:
  - Ensure that all contractors and sub-suppliers use trusted means of shipping (e.g., bonded/cleared/vetted and insured couriers) to ensure that components, once purchased, are not subject to compromise 
  - Prevent or detect tampering with critical hardware or firmware components while in transit through use of state-of-the-art anti-tamper devices.
  - Use tamper-resistant and tamper-evident packaging when shipping critical components (e.g., plastic coating for circuit boards, tamper tape, paint, sensors, and/or seals for cases and containers) and i
MITRE CAPEC-523: Malicious Software Implanted

Description:
An attacker implants malicious software into the system in the supply chain distribution channel, with purpose of causing malicious disruption or allowing for additional compromise when the system is deployed.

Mitigations:
  - Deploy strong code integrity policies to allow only authorized apps to run.
  - Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities.
  - Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and r
MITRE CAPEC-524: Rogue Integration Procedures

Description:
An attacker alters or establishes rogue processes in an integration facility in order to insert maliciously altered components into the system. The attacker would then supply the malicious components. This would allow for malicious disruption or additional compromise when the system is deployed.

Mitigations:
  - Deploy strong code integrity policies to allow only authorized apps to run.
  - Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities.
  - Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and r
MITRE CAPEC-528: XML Flood

Description:
An adversary may execute a flooding attack using XML messages with the intent to deny legitimate users access to a web service. These attacks are accomplished by sending a large number of XML based requests and letting the service attempt to parse each one. In many cases this type of an attack will result in a XML Denial of Service (XDoS) due to an application becoming unstable, freezing, or crashing.

Mitigations:
  - Design: Build throttling mechanism into the resource allocation. Provide for a timeout mechanism for allocated resources whose transaction does not complete within a specified interval.
  - Implementation: Provide for network flow control and traffic shaping to control access to the resources.

Related CWEs: 770
MITRE CAPEC-529: Malware-Directed Internal Reconnaissance

Description:
Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.

Mitigations:
  - Keep patches up to date by installing weekly or daily if possible.
  - Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
MITRE CAPEC-53: Postfix, Null Terminate, and Backslash

Description:
If a string is passed through a filter of some kind, then a terminal NULL may not be valid. Using alternate representation of NULL allows an adversary to embed the NULL mid-string while postfixing the proper data so that the filter is avoided. One example is a filter that looks for a trailing slash character. If a string insertion is possible, but the slash must exist, an alternate encoding of NULL in mid-string may be used.

Mitigations:
  - Properly handle Null characters. Make sure canonicalization is properly applied. Do not pass Null characters to the underlying APIs.
  - Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should 

Related CWEs: 158, 172, 173, 74, 20, 697, 707
MITRE CAPEC-530: Provide Counterfeit Component

Description:
An attacker provides a counterfeit component during the procurement process of a lower-tier component supplier to a sub-system developer or integrator, which is then built into the system being upgraded or repaired by the victim, allowing the attacker to cause disruption or additional compromise.

Mitigations:
  - There are various methods to detect if the component is a counterfeit. See section II of [REF-703] for many techniques.
MITRE CAPEC-531: Hardware Component Substitution

Description:
An attacker substitutes out a tested and approved hardware component for a maliciously-altered hardware component. This type of attack is carried out directly on the system, enabling the attacker to then cause disruption or additional compromise.
MITRE CAPEC-532: Altered Installed BIOS

Description:
An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.

Mitigations:
  - Deploy strong code integrity policies to allow only authorized apps to run.
  - Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities.
  - Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and r
MITRE CAPEC-533: Malicious Manual Software Update

Description:
An attacker introduces malicious code to the victim's system by altering the payload of a software update, allowing for additional compromise or site disruption at the victim location. These manual, or user-assisted attacks, vary from requiring the user to download and run an executable, to as streamlined as tricking the user to click a URL. Attacks which aim at penetrating a specific network infrastructure often rely upon secondary attack methods to achieve the desired impact. Spamming, for example, is a common method employed as an secondary attack vector. Thus the attacker has in their arsenal a choice of initial attack vectors ranging from traditional SMTP/POP/IMAP spamming and its varieties, to web-application mechanisms which commonly implement both chat and rich HTML messaging within the user interface.

Mitigations:
  - Only accept software updates from an official source.

Related CWEs: 494
MITRE CAPEC-534: Malicious Hardware Update

Description:
An adversary introduces malicious hardware during an update or replacement procedure, allowing for additional compromise or site disruption at the victim location. After deployment, it is not uncommon for upgrades and replacements to occur involving hardware and various replaceable parts. These upgrades and replacements are intended to correct defects, provide additional features, and to replace broken or worn-out parts. However, by forcing or tricking the replacement of a good component with a defective or corrupted component, an adversary can leverage known defects to obtain a desired malicious impact.
MITRE CAPEC-535: Malicious Gray Market Hardware

Description:
An attacker maliciously alters hardware components that will be sold on the gray market, allowing for victim disruption and compromise when the victim needs replacement hardware components for systems where the parts are no longer in regular supply from original suppliers, or where the hardware components from the attacker seems to be a great benefit from a cost perspective.

Mitigations:
  - Purchase only from authorized resellers.
  - Validate serial numbers from multiple sources
MITRE CAPEC-536: Data Injected During Configuration

Description:
An attacker with access to data files and processes on a victim's system injects malicious data into critical operational data during configuration or recalibration, causing the victim's system to perform in a suboptimal manner that benefits the adversary.

Mitigations:
  - Ensure that proper access control is implemented on all systems to prevent unauthorized access to system files and processes.

Related CWEs: 284
MITRE CAPEC-537: Infiltration of Hardware Development Environment

Description:
An adversary, leveraging the ability to manipulate components of primary support systems and tools within the development and production environments, inserts malicious software within the hardware and/or firmware development environment. The infiltration purpose is to alter developed hardware components in a system destined for deployment at the victim's organization, for the purpose of disruption or further compromise.

Mitigations:
  - Verify software downloads and updates to ensure they have not been modified be adversaries
  - Leverage antivirus tools to detect known malware
  - Do not download software from untrusted sources
MITRE CAPEC-538: Open-Source Library Manipulation

Description:
Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.

Related CWEs: 494, 829
MITRE CAPEC-539: ASIC With Malicious Functionality

Description:
An attacker with access to the development environment process of an application-specific integrated circuit (ASIC) for a victim system being developed or maintained after initial deployment can insert malicious functionality into the system for the purpose of disruption or further compromise.
MITRE CAPEC-54: Query System for Information

Description:
An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide.

Mitigations:
  - Application designers can construct a 'code book' for error messages. When using a code book, application error messages aren't generated in string or stack trace form, but are cataloged and replaced 
  - Application designers can wrap application functionality (preferably through the underlying framework) in an output encoding scheme that obscures or cleanses error messages to prevent such attacks. Su

Related CWEs: 209
MITRE CAPEC-540: Overread Buffers

Description:
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Related CWEs: 125
MITRE CAPEC-541: Application Fingerprinting

Description:
An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.

Related CWEs: 204, 205, 208
MITRE CAPEC-542: Targeted Malware

Description:
An adversary develops targeted malware that takes advantage of a known vulnerability in an organizational information technology environment. The malware crafted for these attacks is based specifically on information gathered about the technology environment. Successfully executing the malware enables an adversary to achieve a wide variety of negative technical impacts.
MITRE CAPEC-543: Counterfeit Websites

Description:
Adversary creates duplicates of legitimate websites. When users visit a counterfeit site, the site can gather information or upload malware.
MITRE CAPEC-544: Counterfeit Organizations

Description:
An adversary creates a false front organizations with the appearance of a legitimate supplier in the critical life cycle path that then injects corrupted/malicious information system components into the organizational supply chain.
MITRE CAPEC-545: Pull Data from System Resources

Description:
An adversary who is authorized or has the ability to search known system resources, does so with the intention of gathering useful information. System resources include files, memory, and other aspects of the target system. In this pattern of attack, the adversary does not necessarily know what they are going to find when they start pulling data. This is different than CAPEC-150 where the adversary knows what they are looking for due to the common location.

Related CWEs: 1239, 1243, 1258, 1266, 1272, 1278, 1323, 1258, 1330
MITRE CAPEC-546: Incomplete Data Deletion in a Multi-Tenant Environment

Description:
An adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment. If a cloud provider fails to completely delete storage and data from former cloud tenants' systems/resources, once these resources are allocated to new, potentially malicious tenants, the latter can probe the provided resources for sensitive information still there.

Mitigations:
  - Cloud providers should completely delete data to render it irrecoverable and inaccessible from any layer and component of infrastructure resources.
  - Deletion of data should be completed promptly when requested.

Related CWEs: 284, 1266, 1272
MITRE CAPEC-547: Physical Destruction of Device or Component

Description:
An adversary conducts a physical attack a device or component, destroying it such that it no longer functions as intended.
MITRE CAPEC-548: Contaminate Resource

Description:
An adversary contaminates organizational information systems (including devices and networks) by causing them to handle information of a classification/sensitivity for which they have not been authorized. When this happens, the contaminated information system, device, or network must be brought offline to investigate and mitigate the data spill, which denies availability of the system until the investigation is complete.

Mitigations:
  - Properly safeguard classified/sensitive data. This includes training cleared individuals to ensure they are handling and disposing of this data properly, as well as ensuring systems only handle inform
  - Design systems with redundancy in mind. This could mean creating backing servers that could be switched over to in the event that a server has to be taken down for investigation.
  - Have a planned and efficient response plan to limit the amount of time a system is offline while the contamination is investigated.
MITRE CAPEC-549: Local Execution of Code

Description:
An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.

Mitigations:
  - Employ robust cybersecurity training for all employees.
  - Implement system antivirus software that scans all attachments before opening them.
  - Regularly patch all software.

Related CWEs: 829