Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries are known to use code signing certificates to masquerade malware and tools as legitimate binaries (Citation: Janicab).

Output: T1116

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries are known to use code signing certificates to masquerade malware and tools as legitimate binaries (Citation: Janicab). ### Response: T1116.


Instruction: List the MITRE techniques contained in the text.

Input: The certificates used during an operation may be created, forged, or stolen by the adversary.

Output: T1116

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The certificates used during an operation may be created, forged, or stolen by the adversary. ### Response: T1116.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates)

Output: T1116

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) ### Response: T1116.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing to verify software on first run can be used on modern Windows and macOS/OS X systems.

Output: T1116

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing to verify software on first run can be used on modern Windows and macOS/OS X systems. ### Response: T1116.


Instruction: List the MITRE techniques contained in the text.

Input: It is not used on Linux due to the decentralized nature of the platform.

Output: T1116

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is not used on Linux due to the decentralized nature of the platform. ### Response: T1116.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Wikipedia Code Signing)

Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

Output: T1116

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia Code Signing)

Code signing certificates may be used to bypass security policies that require signed code to execute on a system. ### Response: T1116.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse mavinject.exe to proxy execution of malicious code.

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse mavinject.exe to proxy execution of malicious code. ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject)

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject) ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. <code>C:\Windows\system32\mavinject.exe

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. <code>C:\Windows\system32\mavinject.exe ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: PID /INJECTRUNNING

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PID /INJECTRUNNING ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: PATH_DLL</code>).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject)

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PATH_DLL</code>).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject) ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process.

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process. ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its  /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER).

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its  /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed)

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed) ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

Output: T1522

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. ### Response: T1522.


Instruction: List the MITRE techniques contained in the text.

Input: Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance.

Output: T1522

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. ### Response: T1522.


Instruction: List the MITRE techniques contained in the text.

Input: Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets.

Output: T1522

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. ### Response: T1522.


Instruction: List the MITRE techniques contained in the text.

Input: The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API)

Output: T1522

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) ### Response: T1522.


Instruction: List the MITRE techniques contained in the text.

Input: If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources.

Output: T1522

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. ### Response: T1522.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, attackers may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows the attacker to gain access to the sensitive information via a request to the Instance Metadata API.(Citation:

Output: T1522

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, attackers may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows the attacker to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: ### Response: T1522.


Instruction: List the MITRE techniques contained in the text.

Input: RedLock Instance Metadata API 2018)

Output: T1522

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RedLock Instance Metadata API 2018) ### Response: T1522.


Instruction: List the MITRE techniques contained in the text.

Input: The de facto standard across cloud service providers is to host the Instance Metadata API at http[:]//169.254.169.254.

Output: T1522

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The de facto standard across cloud service providers is to host the Instance Metadata API at http[:]//169.254.169.254. ### Response: T1522.


Instruction: List the MITRE techniques contained in the text.

Input: Process hollowing occurs when a process is created in a suspended state then its memory is unmapped and replaced with malicious code.

Output: T1093

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process hollowing occurs when a process is created in a suspended state then its memory is unmapped and replaced with malicious code. ### Response: T1093.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), execution of the malicious code is masked under a legitimate process and may evade defenses and detection analysis.

Output: T1093

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), execution of the malicious code is masked under a legitimate process and may evade defenses and detection analysis. ### Response: T1093.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Leitch Hollowing) (Citation: Elastic Process Injection July 2017)

Output: T1093

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Leitch Hollowing) (Citation: Elastic Process Injection July 2017) ### Response: T1093.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may stage collected data in a central location or directory prior to Exfiltration.

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may stage collected data in a central location or directory prior to Exfiltration. ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560).

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017) ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration.

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection. ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration.

Output: T1074.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. ### Response: T1074.001.


Instruction: List the MITRE techniques contained in the text.

Input: Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560).

Output: T1074.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). ### Response: T1074.001.


Instruction: List the MITRE techniques contained in the text.

Input: Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.

Output: T1074.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. ### Response: T1074.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)

Output: T1074.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021) ### Response: T1074.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: This is done for the sake of evading defenses and observation.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is done for the sake of evading defenses and observation. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe).

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use the same icon of the file they are trying to mimic.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use the same icon of the file they are trying to mimic. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: Domain fronting takes advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS.

Output: T1172

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain fronting takes advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. ### Response: T1172.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Fifield Blocking Resistent Communication through domain fronting 2015)

Output: T1172

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) ### Response: T1172.


Instruction: List the MITRE techniques contained in the text.

Input: The technique involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header.

Output: T1172

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The technique involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. ### Response: T1172.


Instruction: List the MITRE techniques contained in the text.

Input: If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header.

Output: T1172

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. ### Response: T1172.


Instruction: List the MITRE techniques contained in the text.

Input: A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).

Output: T1172

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). ### Response: T1172.


Instruction: List the MITRE techniques contained in the text.

Input: For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header.

Output: T1172

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. ### Response: T1172.


Instruction: List the MITRE techniques contained in the text.

Input: Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.

Output: T1172

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Traffic will appear to be going to domain-x, however the CDN may route it to domain-y. ### Response: T1172.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may build capabilities that can be used during targeting.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may build capabilities that can be used during targeting. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Talos Promethium June 2020)

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos Promethium June 2020) ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: As with legitimate development efforts, different skill sets may be required for developing capabilities.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with legitimate development efforts, different skill sets may be required for developing capabilities. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: The skills needed may be located in-house, or may need to be contracted out.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The skills needed may be located in-house, or may need to be contracted out. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting.

Output: T1587.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. ### Response: T1587.003.


Instruction: List the MITRE techniques contained in the text.

Input: SSL/TLS certificates are designed to instill trust.

Output: T1587.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SSL/TLS certificates are designed to instill trust. ### Response: T1587.003.


Instruction: List the MITRE techniques contained in the text.

Input: They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct.

Output: T1587.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. ### Response: T1587.003.


Instruction: List the MITRE techniques contained in the text.

Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

Output: T1587.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. ### Response: T1587.003.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).

Output: T1587.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). ### Response: T1587.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).

Output: T1587.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). ### Response: T1587.003.


Instruction: List the MITRE techniques contained in the text.

Input: After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.

Output: T1587.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control. ### Response: T1587.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018)

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats.

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary.

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Brute forcing credentials may take place at various points during a breach.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Brute forcing credentials may take place at various points during a breach. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201).

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option.

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: Further,  adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation:

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Further,  adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input:
US-CERT-TA18-106A)

Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes.

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: US-CERT-TA18-106A)

Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking)

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access. ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows security identifier (SID) is a unique value that identifies a user or group account.

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows security identifier (SID) is a unique value that identifies a user or group account. ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: SIDs are used by Windows security in both security descriptors and access tokens.

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SIDs are used by Windows security in both security descriptors and access tokens. ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft SID)

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft SID) ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use this mechanism for privilege escalation.

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this mechanism for privilege escalation. ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators.

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021),

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: [Windows Admin Shares](https://attack.mitre.org/techniques/T1077), or [Windows Remote Management](https://attack.mitre.org/techniques/T1028).

Output: T1178

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Windows Admin Shares](https://attack.mitre.org/techniques/T1077), or [Windows Remote Management](https://attack.mitre.org/techniques/T1028). ### Response: T1178.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target user email to collect sensitive information.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target user email to collect sensitive information. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can collect or forward email from mail servers or clients.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can collect or forward email from mail servers or clients. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target user email on local systems to collect sensitive information.

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target user email on local systems to collect sensitive information. ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook stores data locally in offline data files with an extension of .ost.

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook stores data locally in offline data files with an extension of .ost. ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes)

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files.

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files) ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for common password storage locations to obtain user credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for common password storage locations to obtain user credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire credentials from Keychain.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire credentials from Keychain. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: The default Keychain is the Login Keychain, which stores user passwords and information.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The default Keychain is the Login Keychain, which stores user passwords and information. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: The System Keychain stores items accessed by the operating system, such as items shared among users on a host.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The System Keychain stores items accessed by the operating system, such as items shared among users on a host. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann)

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann) ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather user credentials from Keychain storage/memory.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather user credentials from Keychain storage/memory. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also directly read Login Keychain credentials from the <code>~/Library/Keychains/login.keychain</code> file.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also directly read Login Keychain credentials from the <code>~/Library/Keychains/login.keychain</code> file. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt)

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify shortcuts that can execute a program during system boot or user login.

Output: T1547.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify shortcuts that can execute a program during system boot or user login. ### Response: T1547.009.


Instruction: List the MITRE techniques contained in the text.

Input: Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Output: T1547.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. ### Response: T1547.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence )

Output: T1547.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence ) ### Response: T1547.009.


Instruction: List the MITRE techniques contained in the text.

Input: Although often used as payloads in an infection chain (e.g. [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)), adversaries may also create a new shortcut as a means of indirection, while also abusing [Masquerading](https://attack.mitre.org/techniques/T1036) to make the malicious shortcut appear as a legitimate program.

Output: T1547.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although often used as payloads in an infection chain (e.g. [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)), adversaries may also create a new shortcut as a means of indirection, while also abusing [Masquerading](https://attack.mitre.org/techniques/T1036) to make the malicious shortcut appear as a legitimate program. ### Response: T1547.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can also edit the target path or entirely replace an existing shortcut

Output: T1547.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can also edit the target path or entirely replace an existing shortcut ### Response: T1547.009.


Instruction: List the MITRE techniques contained in the text.

Input: so their malware will be executed instead of the intended legitimate program.

Output: T1547.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: so their malware will be executed instead of the intended legitimate program. ### Response: T1547.009.


Instruction: List the MITRE techniques contained in the text.

Input: Shortcuts can also be abused to establish persistence by implementing other methods.

Output: T1547.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Shortcuts can also be abused to establish persistence by implementing other methods. ### Response: T1547.009.


Instruction: List the MITRE techniques contained in the text.

Input: For example, LNK browser extensions may be modified (e.g. [Browser Extensions](https://attack.mitre.org/techniques/T1176)) to persistently launch malware.

Output: T1547.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, LNK browser extensions may be modified (e.g. [Browser Extensions](https://attack.mitre.org/techniques/T1176)) to persistently launch malware. ### Response: T1547.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify the kernel to automatically execute programs on system boot.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify the kernel to automatically execute programs on system boot. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: They extend the functionality of the kernel without the need to reboot the system.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They extend the functionality of the kernel without the need to reboot the system. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input:
For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming)

When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0).(Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.(Citation: iDefense Rootkit Overview)

Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming)

When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0).(Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.(Citation: iDefense Rootkit Overview)

Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Kexts are loaded and unloaded through kextload and kextunload commands.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kexts are loaded and unloaded through kextload and kextunload commands. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Developers without these privileges may still sign kexts but they will not load unless SIP is disabled.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: If SIP is enabled, the kext signature is verified before being added to the AuxKC.(Citation:

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If SIP is enabled, the kext signature is verified before being added to the AuxKC.(Citation: ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: System and kernel extensions in macOS)

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: System and kernel extensions in macOS) ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.(Citation:

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.(Citation: ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Apple Kernel Extension Deprecation)

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple Kernel Extension Deprecation) ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use LKMs and kexts to conduct [Persistence](https://attack.mitre.org/tactics/TA0003) and/or

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use LKMs and kexts to conduct [Persistence](https://attack.mitre.org/tactics/TA0003) and/or ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) on a system.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) on a system. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Examples have been found in the wild, and there are some relevant open source projects as well.(Citation: Volatility Phalanx2)(Citation:

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples have been found in the wild, and there are some relevant open source projects as well.(Citation: Volatility Phalanx2)(Citation: ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: CrowdStrike Linux Rootkit)(Citation:

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CrowdStrike Linux Rootkit)(Citation: ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub Reptile)(Citation:

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub Reptile)(Citation: ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle)(Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir)(Citation: Trend Micro Skidmap)

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle)(Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir)(Citation: Trend Micro Skidmap) ### Response: T1547.006.