Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing can be targeted, known as spearphishing.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing can be targeted, known as spearphishing. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input:
Sophos Attachment)(Citation: GitHub Phishery) Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing)

Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sophos Attachment)(Citation: GitHub Phishery) Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing)

Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input:
Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Palo Alto Unit 42 VBA Infostealer 2014)

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Palo Alto Unit 42 VBA Infostealer 2014) ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.(Citation: Sophos Attachment)(Citation: GitHub Phishery)

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.(Citation: Sophos Attachment)(Citation: GitHub Phishery) ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation:

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video)

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation:

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: Demystifying Azure AD Service Principals)

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Demystifying Azure AD Service Principals) ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add)

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation:

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: Expel IO Evil in AWS)(Citation:

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Expel IO Evil in AWS)(Citation: ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: Expel Behind the Scenes)

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Expel Behind the Scenes) ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account.

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0)

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal.

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation:

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: SpecterOps Azure Privilege Escalation)

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SpecterOps Azure Privilege Escalation) ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account.

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account. ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: These credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated. ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Crowdstrike AWS User Federation Persistence)

Output: T1098.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Crowdstrike AWS User Federation Persistence) ### Response: T1098.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may rely upon a user opening a malicious file in order to gain execution.

Output: T1204.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may rely upon a user opening a malicious file in order to gain execution. ### Response: T1204.002.


Instruction: List the MITRE techniques contained in the text.

Input: Users may be subjected to social engineering to get them to open a file that will lead to code execution.

Output: T1204.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users may be subjected to social engineering to get them to open a file that will lead to code execution. ### Response: T1204.002.


Instruction: List the MITRE techniques contained in the text.

Input: This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).

Output: T1204.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). ### Response: T1204.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.

Output: T1204.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl. ### Response: T1204.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file.

Output: T1204.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. ### Response: T1204.002.


Instruction: List the MITRE techniques contained in the text.

Input: These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs)

Output: T1204.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) ### Response: T1204.002.


Instruction: List the MITRE techniques contained in the text.

Input: While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it.

Output: T1204.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. ### Response: T1204.002.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).

Output: T1204.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). ### Response: T1204.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may rely on a user running a malicious image to facilitate execution.

Output: T1204.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may rely on a user running a malicious image to facilitate execution. ### Response: T1204.003.


Instruction: List the MITRE techniques contained in the text.

Input: Amazon Web Services (AWS)

Output: T1204.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Amazon Web Services (AWS) ### Response: T1204.003.


Instruction: List the MITRE techniques contained in the text.

Input: Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored.

Output: T1204.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. ### Response: T1204.003.


Instruction: List the MITRE techniques contained in the text.

Input: Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access.

Output: T1204.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. ### Response: T1204.003.


Instruction: List the MITRE techniques contained in the text.

Input: This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)

Output: T1204.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) ### Response: T1204.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)

Output: T1204.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021) ### Response: T1204.003.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may rely upon a user clicking a malicious link in order to gain execution.

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may rely upon a user clicking a malicious link in order to gain execution. ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: Users may be subjected to social engineering to get them to click on a link that will lead to code execution.

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users may be subjected to social engineering to get them to click on a link that will lead to code execution. ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002).

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002). ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may rely upon specific actions by a user in order to gain execution.

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may rely upon specific actions by a user in order to gain execution. ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link.

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it.

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also deceive users into performing actions such as enabling [Remote Access Software](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary, or downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also deceive users into performing actions such as enabling [Remote Access Software](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary, or downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction.

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Software](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery)

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Software](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery) ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.

Output: T1491

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. ### Response: T1491.


Instruction: List the MITRE techniques contained in the text.

Input: Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion.

Output: T1491

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. ### Response: T1491.


Instruction: List the MITRE techniques contained in the text.

Input: Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.

Output: T1491

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages. ### Response: T1491.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Output: T1491.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. ### Response: T1491.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)

Output: T1491.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) ### Response: T1491.001.


Instruction: List the MITRE techniques contained in the text.

Input: Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages.

Output: T1491.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. ### Response: T1491.001.


Instruction: List the MITRE techniques contained in the text.

Input: Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)

Output: T1491.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware) ### Response: T1491.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system.

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation:

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: MalwareBytes ADS July 2015)

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MalwareBytes ADS July 2015) ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020) ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use hidden users to hide the presence of user accounts they create or modify.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use hidden users to hide the presence of user accounts they create or modify. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: To prevent a user from being shown on the login screen and in System Preferences, adversaries can set the userID to be under 500 and set the key value Hide500Users to TRUE in the /Library/Preferences/com.apple.loginwindow plist file.(Citation:

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To prevent a user from being shown on the login screen and in System Preferences, adversaries can set the userID to be under 500 and set the key value Hide500Users to TRUE in the /Library/Preferences/com.apple.loginwindow plist file.(Citation: ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Cybereason OSX Pirrit)

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cybereason OSX Pirrit) ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Every user has a userID associated with it.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Every user has a userID associated with it. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: When the Hide500Users

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the Hide500Users ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: key value is set to TRUE, users with a userID under 500 do not appear on the login screen and in System Preferences.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: key value is set to TRUE, users with a userID under 500 do not appear on the login screen and in System Preferences. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Using the command line, adversaries can use the dscl utility to create hidden user accounts by setting the IsHidden attribute to 1.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using the command line, adversaries can use the dscl utility to create hidden user accounts by setting the IsHidden attribute to 1. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can also hide a user’s home folder by changing the chflags to hidden.(Citation: Apple Support Hide a User Account)

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can also hide a user’s home folder by changing the chflags to hidden.(Citation: Apple Support Hide a User Account) ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may similarly hide user accounts in Windows.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may similarly hide user accounts in Windows. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can set the <code>HKLM\SOFTWARE\Microsoft\Windows

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can set the <code>HKLM\SOFTWARE\Microsoft\Windows ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: NT\CurrentVersion\Winlogon\SpecialAccounts\UserList</code>

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NT\CurrentVersion\Winlogon\SpecialAccounts\UserList</code> ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.(Citation:

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.(Citation: ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye SMOKEDHAM June 2021)(Citation: US-CERT TA18-074A)

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye SMOKEDHAM June 2021)(Citation: US-CERT TA18-074A) ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux systems, adversaries may hide user accounts from the login screen, also referred to as the greeter.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux systems, adversaries may hide user accounts from the login screen, also referred to as the greeter. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: The method an adversary may use depends on which Display Manager the distribution is currently using.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The method an adversary may use depends on which Display Manager the distribution is currently using. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, on an Ubuntu system using the GNOME Display Manger (GDM), accounts may be hidden from the greeter using the gsettings command (ex: sudo -u gdm gsettings set org.gnome.login-screen disable-user-list true).(Citation:

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on an Ubuntu system using the GNOME Display Manger (GDM), accounts may be hidden from the greeter using the gsettings command (ex: sudo -u gdm gsettings set org.gnome.login-screen disable-user-list true).(Citation: ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Hide GDM User Accounts)

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hide GDM User Accounts) ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Display Managers are not anchored to specific distributions and may be changed by a user or adversary.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Display Managers are not anchored to specific distributions and may be changed by a user or adversary. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: Windows uses access tokens to determine the ownership of a running process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows uses access tokens to determine the ownership of a running process. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: When this occurs, the process also takes on the security context associated with the new token.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When this occurs, the process also takes on the security context associated with the new token. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)).

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary must already be in a privileged user context (i.e. administrator) to steal a token.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary must already be in a privileged user context (i.e. administrator) to steal a token. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input:
An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls.

Output: T1134.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. ### Response: T1134.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.

Output: T1134.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. ### Response: T1134.003.


Instruction: List the MITRE techniques contained in the text.

Input: The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.

Output: T1134.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. ### Response: T1134.003.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.

Output: T1134.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one. ### Response: T1134.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials.

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials. ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)). ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP).

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: GPP are tools that allow administrators to create domain policies with embedded credentials.

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GPP are tools that allow administrators to create domain policies with embedded credentials. ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: These policies allow administrators to set local accounts.(Citation:

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These policies allow administrators to set local accounts.(Citation: ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft GPP 2016)

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft GPP 2016) ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: These group policies are stored in SYSVOL on a domain controller.

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These group policies are stored in SYSVOL on a domain controller. ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key)

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key) ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files: ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input:
* Metasploit’s post exploitation module: post/windows/gather/credentials/gpp
* Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword)
* gpprefdecrypt.py

On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Metasploit’s post exploitation module: post/windows/gather/credentials/gpp
* Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword)
* gpprefdecrypt.py

On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: .xml</code>

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: .xml</code> ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: Windows Control Panel items are utilities that allow users to view and adjust computer settings.

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows Control Panel items are utilities that allow users to view and adjust computer settings. ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Implementing CPL)

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Implementing CPL) ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use Control Panel items as execution payloads to execute arbitrary commands.

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use Control Panel items as execution payloads to execute arbitrary commands. ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious Control Panel items can be delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) campaigns (Citation: TrendMicro CPL Malware Jan 2014)

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious Control Panel items can be delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) campaigns (Citation: TrendMicro CPL Malware Jan 2014) ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Palo Alto Reaver Nov 2017)

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Palo Alto Reaver Nov 2017) ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: Control Panel items, specifically CPL files, may also bypass application and/or file extension whitelisting.

Output: T1196

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Control Panel items, specifically CPL files, may also bypass application and/or file extension whitelisting. ### Response: T1196.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: The data may also be sent to an alternate network location from the main command and control server.

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The data may also be sent to an alternate network location from the main command and control server. ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel.

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also opt to encrypt and/or obfuscate these alternate channels.

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also opt to encrypt and/or obfuscate these alternate channels. ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016)

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input:
On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)

Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)

Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009). ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel.

Output: T1048.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. ### Response: T1048.002.


Instruction: List the MITRE techniques contained in the text.

Input: The data may also be sent to an alternate network location from the main command and control server.

Output: T1048.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The data may also be sent to an alternate network location from the main command and control server. ### Response: T1048.002.


Instruction: List the MITRE techniques contained in the text.

Input: Asymmetric encryption algorithms are those that use different keys on each end of the channel.

Output: T1048.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Asymmetric encryption algorithms are those that use different keys on each end of the channel. ### Response: T1048.002.


Instruction: List the MITRE techniques contained in the text.

Input: Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key.

Output: T1048.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. ### Response: T1048.002.


Instruction: List the MITRE techniques contained in the text.

Input: Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity.

Output: T1048.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. ### Response: T1048.002.


Instruction: List the MITRE techniques contained in the text.

Input: The public keys of each entity are exchanged before encrypted communications begin.

Output: T1048.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The public keys of each entity are exchanged before encrypted communications begin. ### Response: T1048.002.


Instruction: List the MITRE techniques contained in the text.

Input: Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged.

Output: T1048.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. ### Response: T1048.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.

Output: T1048.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may opt to use these encrypted mechanisms that are baked into a protocol. ### Response: T1048.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1087.