Instruction: List the MITRE techniques contained in the text.

Input: This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539),

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator)

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005)), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.(Citation:

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005)), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.(Citation: ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: AWS Temporary Security Credentials)(Citation: Zimbra Preauth)

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AWS Temporary Security Credentials)(Citation: Zimbra Preauth) ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation:

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation:

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft SolarWinds Customer Guidance)

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft SolarWinds Customer Guidance) ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps)

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps) ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token.

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.(Citation: Microsoft SAML Token Lifetimes)

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.(Citation: Microsoft SAML Token Lifetimes) ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation:

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: Cyberark Golden SAML)

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cyberark Golden SAML) ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may utilize [Private Keys](https://attack.mitre.org/techniques/T1552/004) to compromise an organization's token-signing certificate to create forged SAML tokens.

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may utilize [Private Keys](https://attack.mitre.org/techniques/T1552/004) to compromise an organization's token-signing certificate to create forged SAML tokens. ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate.(Citation: Microsoft SolarWinds Customer Guidance)

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate.(Citation: Microsoft SolarWinds Customer Guidance) ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: This differs from [Steal Application Access Token](https://attack.mitre.org/techniques/T1528) and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This differs from [Steal Application Access Token](https://attack.mitre.org/techniques/T1528) and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users. ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account.

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account. ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: This may lead to [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Microsoft SolarWinds Customer Guidance)

Output: T1606.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may lead to [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Microsoft SolarWinds Customer Guidance) ### Response: T1606.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing with a link is a specific variant of spearphishing.

Output: T1192

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing with a link is a specific variant of spearphishing. ### Response: T1192.


Instruction: List the MITRE techniques contained in the text.

Input: It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.

Output: T1192

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. ### Response: T1192.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1192

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1192.


Instruction: List the MITRE techniques contained in the text.

Input: In this case, the malicious emails contain links.

Output: T1192

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this case, the malicious emails contain links. ### Response: T1192.


Instruction: List the MITRE techniques contained in the text.

Input: Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1192

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1192.


Instruction: List the MITRE techniques contained in the text.

Input: The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.

Output: T1192

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. ### Response: T1192.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email (i.e. web bugs/web beacons).

Output: T1192

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email (i.e. web bugs/web beacons). ### Response: T1192.


Instruction: List the MITRE techniques contained in the text.

Input: Links may also direct users to malicious applications  designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, in order to gain access to protected applications and information.(Citation: Trend Micro Pawn Storm OAuth 2017)

Output: T1192

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Links may also direct users to malicious applications  designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, in order to gain access to protected applications and information.(Citation: Trend Micro Pawn Storm OAuth 2017) ### Response: T1192.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Various file types have a typical standard format, including how they are encoded and organized.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various file types have a typical standard format, including how they are encoded and organized. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the header of a JPEG file,  is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the header of a JPEG file,  is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001))

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: so that adversaries may move their malware without triggering detections.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: so that adversaries may move their malware without triggering detections. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: A user may not know that a file is malicious due to the benign appearance and file extension.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user may not know that a file is malicious due to the benign appearance and file extension. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Polygot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Polygot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID) ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

Output: T1489

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. ### Response: T1489.


Instruction: List the MITRE techniques contained in the text.

Input: Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation:

Output: T1489

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: ### Response: T1489.


Instruction: List the MITRE techniques contained in the text.

Input: Novetta Blockbuster)

Output: T1489

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Novetta Blockbuster) ### Response: T1489.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster).

Output: T1489

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). ### Response: T1489.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018)

Output: T1489

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) ### Response: T1489.


Instruction: List the MITRE techniques contained in the text.

Input: Services or processes may not allow for modification of their data stores while running.

Output: T1489

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Services or processes may not allow for modification of their data stores while running. ### Response: T1489.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation:

Output: T1489

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: ### Response: T1489.


Instruction: List the MITRE techniques contained in the text.

Input: SecureWorks WannaCry Analysis)

Output: T1489

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SecureWorks WannaCry Analysis) ### Response: T1489.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may build capabilities that can be used during targeting.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may build capabilities that can be used during targeting. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Talos Promethium June 2020)

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos Promethium June 2020) ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: As with legitimate development efforts, different skill sets may be required for developing capabilities.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with legitimate development efforts, different skill sets may be required for developing capabilities. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: The skills needed may be located in-house, or may need to be contracted out.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The skills needed may be located in-house, or may need to be contracted out. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop malware and malware components that can be used during targeting.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop malware and malware components that can be used during targeting. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: As with legitimate development efforts, different skill sets may be required for developing malware.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with legitimate development efforts, different skill sets may be required for developing malware. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: The skills needed may be located in-house, or may need to be contracted out.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The skills needed may be located in-house, or may need to be contracted out. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29) ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Regsvcs and Regasm are Windows command-line utilities that are used to register .NET

Output: T1121

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Regsvcs and Regasm are Windows command-line utilities that are used to register .NET ### Response: T1121.


Instruction: List the MITRE techniques contained in the text.

Input: Component Object Model (COM) assemblies.

Output: T1121

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Component Object Model (COM) assemblies. ### Response: T1121.


Instruction: List the MITRE techniques contained in the text.

Input: Both are digitally signed by Microsoft.

Output: T1121

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both are digitally signed by Microsoft. ### Response: T1121.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)

Output: T1121

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) ### Response: T1121.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility.

Output: T1121

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. ### Response: T1121.


Instruction: List the MITRE techniques contained in the text.

Input: Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively.

Output: T1121

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. ### Response: T1121.


Instruction: List the MITRE techniques contained in the text.

Input: The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.

Output: T1121

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. ### Response: T1121.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)

Output: T1121

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm) ### Response: T1121.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to enumerate local device drivers on a victim host.

Output: T1652

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to enumerate local device drivers on a victim host. ### Response: T1652.


Instruction: List the MITRE techniques contained in the text.

Input: Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).

Output: T1652

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)). ### Response: T1652.


Instruction: List the MITRE techniques contained in the text.

Input: Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation:

Output: T1652

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: ### Response: T1652.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers)

Output: T1652

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) ### Response: T1652.


Instruction: List the MITRE techniques contained in the text.

Input: Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers)

Output: T1652

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers) ### Response: T1652.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)

Output: T1652

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man) ### Response: T1652.


Instruction: List the MITRE techniques contained in the text.

Input: The sudo command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The sudo command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments." ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: sudo man page 2018)

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: sudo man page 2018) ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout that is the amount of time in minutes between instances of sudo before it will re-prompt for a password.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout that is the amount of time in minutes between instances of sudo before it will re-prompt for a password. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: This is because sudo has the ability to cache credentials for a period of time.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is because sudo has the ability to cache credentials for a period of time. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: Sudo creates (or touches) a file at <code>/var/db/sudo</code> with a timestamp of when sudo was last run to determine this timeout.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sudo creates (or touches) a file at <code>/var/db/sudo</code> with a timestamp of when sudo was last run to determine this timeout. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again). ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse poor configurations of this to escalate privileges without needing the user's password.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse poor configurations of this to escalate privileges without needing the user's password. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: If it does, then malware can execute sudo commands without needing to supply the user's password.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If it does, then malware can execute sudo commands without needing to supply the user's password. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: When tty_tickets is disabled, adversaries can do this from any tty for that user.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When tty_tickets is disabled, adversaries can do this from any tty for that user. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: The OSX Proton Malware has disabled tty_tickets to potentially make scripting easier by issuing echo \'Defaults !

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The OSX Proton Malware has disabled tty_tickets to potentially make scripting easier by issuing echo \'Defaults ! ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: tty_tickets\' >> /etc/sudoers</code>  (Citation: cybereason osx proton).

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: tty_tickets\' >> /etc/sudoers</code>  (Citation: cybereason osx proton). ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: In order for this change to be reflected, the Proton malware also must issue <code>killall

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In order for this change to be reflected, the Proton malware also must issue <code>killall ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: Terminal</code>.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Terminal</code>. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: As of macOS Sierra, the sudoers file has tty_tickets enabled by default.

Output: T1206

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As of macOS Sierra, the sudoers file has tty_tickets enabled by default. ### Response: T1206.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: Information about email addresses and accounts may also be extracted by searching an infected system’s files.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about email addresses and accounts may also be extracted by searching an infected system’s files. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of domain accounts.

Output: T1087.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of domain accounts. ### Response: T1087.002.


Instruction: List the MITRE techniques contained in the text.

Input:
This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.

Output: T1087.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. ### Response: T1087.002.


Instruction: List the MITRE techniques contained in the text.

Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.

Output: T1087.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups. ### Response: T1087.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation:

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may achieve the same goal by modifying or extending features of the kernel.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may achieve the same goal by modifying or extending features of the kernel. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Active Setup is a Windows mechanism that is used to execute programs when a user logs in.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Active Setup is a Windows mechanism that is used to execute programs when a user logs in. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010)

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: These programs will be executed under the context of the user and will have the account's associated permissions level.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These programs will be executed under the context of the user and will have the account's associated permissions level. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Active Setup by creating a key under  HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Active Setup by creating a key under  HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation:

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye CFR Watering Hole 2012)(Citation:

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye CFR Watering Hole 2012)(Citation: ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016)

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, windows that would typically be displayed when an application carries out an operation can be hidden.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows, there are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows, there are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: One example of this is <code>powershell.exe -WindowStyle

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One example of this is <code>powershell.exe -WindowStyle ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: Hidden</code>.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hidden</code>. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: PowerShell About 2019)

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: PowerShell About 2019) ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on macOS the configurations for how applications run are listed in property list (plist) files.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on macOS the configurations for how applications run are listed in property list (plist) files. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: One of the tags in these files can be <code>apple.awt.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One of the tags in these files can be <code>apple.awt. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: UIElement</code>, which allows for Java applications to prevent the application's icon from appearing in the Dock.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: UIElement</code>, which allows for Java applications to prevent the application's icon from appearing in the Dock. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A common use for this is when applications run in the system tray, but don't also want to show up in the Dock. ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware)

Output: T1564.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware) ### Response: T1564.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals.

Output: T1564.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. ### Response: T1564.011.


Instruction: List the MITRE techniques contained in the text.

Input: Many operating systems use signals to deliver messages to control process behavior.

Output: T1564.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many operating systems use signals to deliver messages to control process behavior. ### Response: T1564.011.


Instruction: List the MITRE techniques contained in the text.

Input: Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man)

Output: T1564.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) ### Response: T1564.011.


Instruction: List the MITRE techniques contained in the text.

Input: These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes.

Output: T1564.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes. ### Response: T1564.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may invoke processes using `nohup`, [PowerShell](https://attack.mitre.org/techniques/T1059/001) `-ErrorAction SilentlyContinue`, or similar commands that may be immune to hangups.(Citation: nohup Linux Man)(Citation: Microsoft PowerShell SilentlyContinue)

Output: T1564.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may invoke processes using `nohup`, [PowerShell](https://attack.mitre.org/techniques/T1059/001) `-ErrorAction SilentlyContinue`, or similar commands that may be immune to hangups.(Citation: nohup Linux Man)(Citation: Microsoft PowerShell SilentlyContinue) ### Response: T1564.011.


Instruction: List the MITRE techniques contained in the text.

Input: This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection.

Output: T1564.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection. ### Response: T1564.011.


Instruction: List the MITRE techniques contained in the text.

Input: Hiding from process interrupt signals may allow malware to continue execution, but unlike [Trap](https://attack.mitre.org/techniques/T1546/005) this does not establish [Persistence](https://attack.mitre.org/tactics/TA0003) since the process will not be re-invoked once actually terminated.

Output: T1564.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hiding from process interrupt signals may allow malware to continue execution, but unlike [Trap](https://attack.mitre.org/techniques/T1546/005) this does not establish [Persistence](https://attack.mitre.org/tactics/TA0003) since the process will not be re-invoked once actually terminated. ### Response: T1564.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use hidden users to hide the presence of user accounts they create or modify.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use hidden users to hide the presence of user accounts they create or modify. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: To prevent a user from being shown on the login screen and in System Preferences, adversaries can set the userID to be under 500 and set the key value Hide500Users to TRUE in the /Library/Preferences/com.apple.loginwindow plist file.(Citation:

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To prevent a user from being shown on the login screen and in System Preferences, adversaries can set the userID to be under 500 and set the key value Hide500Users to TRUE in the /Library/Preferences/com.apple.loginwindow plist file.(Citation: ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Cybereason OSX Pirrit)

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cybereason OSX Pirrit) ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Every user has a userID associated with it.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Every user has a userID associated with it. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: When the Hide500Users

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the Hide500Users ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: key value is set to TRUE, users with a userID under 500 do not appear on the login screen and in System Preferences.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: key value is set to TRUE, users with a userID under 500 do not appear on the login screen and in System Preferences. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Using the command line, adversaries can use the dscl utility to create hidden user accounts by setting the IsHidden attribute to 1.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using the command line, adversaries can use the dscl utility to create hidden user accounts by setting the IsHidden attribute to 1. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can also hide a user’s home folder by changing the chflags to hidden.(Citation: Apple Support Hide a User Account)

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can also hide a user’s home folder by changing the chflags to hidden.(Citation: Apple Support Hide a User Account) ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may similarly hide user accounts in Windows.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may similarly hide user accounts in Windows. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can set the <code>HKLM\SOFTWARE\Microsoft\Windows

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can set the <code>HKLM\SOFTWARE\Microsoft\Windows ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: NT\CurrentVersion\Winlogon\SpecialAccounts\UserList</code>

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NT\CurrentVersion\Winlogon\SpecialAccounts\UserList</code> ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.(Citation:

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.(Citation: ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye SMOKEDHAM June 2021)(Citation: US-CERT TA18-074A)

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye SMOKEDHAM June 2021)(Citation: US-CERT TA18-074A) ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux systems, adversaries may hide user accounts from the login screen, also referred to as the greeter.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux systems, adversaries may hide user accounts from the login screen, also referred to as the greeter. ### Response: T1564.002.


Instruction: List the MITRE techniques contained in the text.

Input: The method an adversary may use depends on which Display Manager the distribution is currently using.

Output: T1564.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The method an adversary may use depends on which Display Manager the distribution is currently using. ### Response: T1564.002.