Instruction: List the MITRE techniques contained in the text.

Input: Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}.

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation:

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation:

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation: ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: Trustwave IIS Module 2013)

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trustwave IIS Module 2013) ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic.

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: ISAPI extensions and filters may have access to all IIS web requests and responses.

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ISAPI extensions and filters may have access to all IIS web requests and responses. ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.(Citation: Microsoft ISAPI Filter Overview 2017)(Citation:

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft ISAPI Extension Overview 2017)(Citation:

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft ISAPI Extension Overview 2017)(Citation: ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft ISAPI Extension All Incoming 2017)(Citation:

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft ISAPI Extension All Incoming 2017)(Citation: ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: Dell TG-3390)(Citation: Trustwave IIS Module 2013)(Citation:

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dell TG-3390)(Citation: Trustwave IIS Module 2013)(Citation: ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: MMPC ISAPI Filter 2012)

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MMPC ISAPI Filter 2012) ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also install malicious IIS modules to observe and/or modify traffic.

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also install malicious IIS modules to observe and/or modify traffic. ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters.

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.(Citation: Microsoft IIS Modules Overview 2007)(Citation: Trustwave IIS Module 2013)(Citation:

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.(Citation: Microsoft IIS Modules Overview 2007)(Citation: Trustwave IIS Module 2013)(Citation: ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: ESET IIS Malware 2021)

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ESET IIS Malware 2021) ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program.

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017) ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002)

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002) ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: , this activity will not result in a valid signature.

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: , this activity will not result in a valid signature. ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system.

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation:

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: MalwareBytes ADS July 2015)

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MalwareBytes ADS July 2015) ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)

Output: T1564

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020) ### Response: T1564.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may carry out malicious operations using a virtual instance to avoid detection.

Output: T1564.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may carry out malicious operations using a virtual instance to avoid detection. ### Response: T1564.006.


Instruction: List the MITRE techniques contained in the text.

Input: A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment.

Output: T1564.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. ### Response: T1564.006.


Instruction: List the MITRE techniques contained in the text.

Input: By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.

Output: T1564.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. ### Response: T1564.006.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)

Output: T1564.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019) ### Response: T1564.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may utilize native support for virtualization (ex: Hyper-V) or drop the necessary files to run a virtual instance (ex: VirtualBox binaries).

Output: T1564.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may utilize native support for virtualization (ex: Hyper-V) or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). ### Response: T1564.006.


Instruction: List the MITRE techniques contained in the text.

Input: After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.(Citation: Sophos Ragnar May 2020)

Output: T1564.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.(Citation: Sophos Ragnar May 2020) ### Response: T1564.006.


Instruction: List the MITRE techniques contained in the text.

Input: The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals.

Output: T1154

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. ### Response: T1154.


Instruction: List the MITRE techniques contained in the text.

Input: A common situation is a script allowing for graceful termination and handling of common  keyboard interrupts like ctrl+c and ctrl+d.

Output: T1154

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A common situation is a script allowing for graceful termination and handling of common  keyboard interrupts like ctrl+c and ctrl+d. ### Response: T1154.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism.

Output: T1154

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. ### Response: T1154.


Instruction: List the MITRE techniques contained in the text.

Input: Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation:

Output: T1154

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: ### Response: T1154.


Instruction: List the MITRE techniques contained in the text.

Input: Trap Manual)(Citation:

Output: T1154

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trap Manual)(Citation: ### Response: T1154.


Instruction: List the MITRE techniques contained in the text.

Input: Cyberciti Trap Statements)

Output: T1154

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cyberciti Trap Statements) ### Response: T1154.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

Output: T1201

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. ### Response: T1201.


Instruction: List the MITRE techniques contained in the text.

Input: Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110).

Output: T1201

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). ### Response: T1201.


Instruction: List the MITRE techniques contained in the text.

Input: This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Output: T1201

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts). ### Response: T1201.


Instruction: List the MITRE techniques contained in the text.

Input: Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l

Output: T1201

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l ### Response: T1201.


Instruction: List the MITRE techniques contained in the text.

Input: <username>, cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies).

Output: T1201

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: <username>, cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). ### Response: T1201.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)

Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy).

Output: T1201

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)

Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy). ### Response: T1201.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by executing malicious content triggered by user inactivity.

Output: T1546.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by executing malicious content triggered by user inactivity. ### Response: T1546.002.


Instruction: List the MITRE techniques contained in the text.

Input: Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver)

Output: T1546.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) ### Response: T1546.002.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\  on 64-bit Windows systems, along with screensavers included with base Windows installations.

Output: T1546.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\  on 64-bit Windows systems, along with screensavers included with base Windows installations. ### Response: T1546.002.


Instruction: List the MITRE techniques contained in the text.

Input:
The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:

* SCRNSAVE.exe - set to malicious PE path
* ScreenSaveActive - set to '1' to enable the screensaver
* ScreenSaverIsSecure - set to '0' to not require a password to unlock
* ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed

Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)

Output: T1546.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:

* SCRNSAVE.exe - set to malicious PE path
* ScreenSaveActive - set to '1' to enable the screensaver
* ScreenSaverIsSecure - set to '0' to not require a password to unlock
* ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed

Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017) ### Response: T1546.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles.

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: A PowerShell profile  (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A PowerShell profile  (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments. ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program.

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code.

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: An administrator can also configure a profile that applies to all users and host programs on the local computer.

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An administrator can also configure a profile that applies to all users and host programs on the local computer. ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft About Profiles)

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft About Profiles) ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence.

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the <code>-NoProfile</code> flag is used when it is launched.

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the <code>-NoProfile</code> flag is used when it is launched. ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: ESET Turla PowerShell May 2019)

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: ESET Turla PowerShell May 2019) ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator.

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wits End and Shady PowerShell Profiles)

Output: T1546.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wits End and Shady PowerShell Profiles) ### Response: T1546.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: Installer packages are OS specific and contain the resources an operating system needs to install applications on a system.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: Installer packages can include scripts that run prior to installation as well as after installation is complete.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Installer packages can include scripts that run prior to installation as well as after installation is complete. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: Installer scripts may inherit elevated permissions when executed.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Installer scripts may inherit elevated permissions when executed. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input:
Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)

Using legitimate applications, adversaries have distributed applications with modified installer scripts to execute malicious content.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)

Using legitimate applications, adversaries have distributed applications with modified installer scripts to execute malicious content. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: When a user installs the application, they may be required to grant administrative permissions to allow the installation.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user installs the application, they may be required to grant administrative permissions to allow the installation. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: At the end of the installation process of the legitimate application, content such as macOS `postinstall` scripts can be executed with the inherited elevated permissions.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: At the end of the installation process of the legitimate application, content such as macOS `postinstall` scripts can be executed with the inherited elevated permissions. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use these scripts to execute a malicious executable or install other malicious components (such as a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)) with the elevated permissions.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: wardle evilquest parti)

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use these scripts to execute a malicious executable or install other malicious components (such as a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)) with the elevated permissions.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: wardle evilquest parti) ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the distribution, Linux versions of package installer scripts are sometimes called maintainer scripts or post installation scripts.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the distribution, Linux versions of package installer scripts are sometimes called maintainer scripts or post installation scripts. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: These scripts can include `preinst`, `postinst`, `prerm`, `postrm` scripts and run as root when executed.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These scripts can include `preinst`, `postinst`, `prerm`, `postrm` scripts and run as root when executed. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: For Windows, the Microsoft Installer services uses `.msi` files to manage the installing, updating, and uninstalling of applications.

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For Windows, the Microsoft Installer services uses `.msi` files to manage the installing, updating, and uninstalling of applications. ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have leveraged `Prebuild` and `Postbuild` events to run commands before or after a build when installing .msi files.(Citation: Windows AppleJeus GReAT)(Citation: Debian Manual Maintainer Scripts)

Output: T1546.016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have leveraged `Prebuild` and `Postbuild` events to run commands before or after a build when installing .msi files.(Citation: Windows AppleJeus GReAT)(Citation: Debian Manual Maintainer Scripts) ### Response: T1546.016.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime.(Citation: Mandiant M-Trends 2015)

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime.(Citation: Mandiant M-Trends 2015) ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015)

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation:

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft MOF May 2018)

WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft MOF May 2018)

WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX)

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: There are tools available to perform these changes.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are tools available to perform these changes. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.(Citation: Malware Persistence on OS X)

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.(Citation: Malware Persistence on OS X) ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Elastic Process Injection July 2017)

Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017)

Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb).

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input:
A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:

*

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:

* ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input:
%WINDIR%\AppPatch\sysmain.sdb and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb

Custom databases are stored in:

* %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom

To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: %WINDIR%\AppPatch\sysmain.sdb and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb

Custom databases are stored in:

* %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom

To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress). ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Application Shimming)

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Application Shimming) ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: Shims can also be abused to establish persistence by continuously being invoked by affected programs.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Shims can also be abused to establish persistence by continuously being invoked by affected programs. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

Output: T1546.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. ### Response: T1546.015.


Instruction: List the MITRE techniques contained in the text.

Input: COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model)  References to various COM objects are stored in the Registry.

Output: T1546.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model)  References to various COM objects are stored in the Registry. ### Response: T1546.015.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence.

Output: T1546.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. ### Response: T1546.015.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed.

Output: T1546.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. ### Response: T1546.015.


Instruction: List the MITRE techniques contained in the text.

Input: When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking)

Output: T1546.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) ### Response: T1546.015.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.

Output: T1546.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. ### Response: T1546.015.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: All login shells on a system use /etc/profile when initiated.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All login shells on a system use /etc/profile when initiated. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc)

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc) ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: These files typically require root permissions to modify and are executed each time any shell on a system launches.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These files typically require root permissions to modify and are executed each time any shell on a system launches. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation: Linux manual bash invocation)

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation: Linux manual bash invocation) ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Since the system only executes the first existing file in the listed order, adversaries have used <code>~/.bash_profile</code> to ensure execution.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the system only executes the first existing file in the listed order, adversaries have used <code>~/.bash_profile</code> to ensure execution. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation: Magento) Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation: Magento) Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation: code_persistence_zsh)(Citation: macOS MS office sandbox escape) The login shell then configures the user environment with ~/.zprofile and ~/.zlogin.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation: code_persistence_zsh)(Citation: macOS MS office sandbox escape) The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: The interactive shell uses the <code>~/.zshrc</code> to configure the user environment.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The interactive shell uses the <code>~/.zshrc</code> to configure the user environment. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Upon exiting, /etc/zlogout and ~/.zlogout are executed.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Upon exiting, /etc/zlogout and ~/.zlogout are executed. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: For legacy programs, macOS executes <code>/etc/bashrc</code> on startup.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For legacy programs, macOS executes <code>/etc/bashrc</code> on startup. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: In practice this is nearly every program, since user32.dll is a very common library.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In practice this is nearly every program, since user32.dll is a very common library. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Elastic Process Injection July 2017)

Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017)

Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppInit Registry)

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AppInit Registry) ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppInit Secure Boot)

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AppInit Secure Boot) ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal.

Output: T1546.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. ### Response: T1546.005.


Instruction: List the MITRE techniques contained in the text.

Input: The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals.

Output: T1546.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. ### Response: T1546.005.


Instruction: List the MITRE techniques contained in the text.

Input: A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.

Output: T1546.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. ### Response: T1546.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism.

Output: T1546.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. ### Response: T1546.005.


Instruction: List the MITRE techniques contained in the text.

Input: Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation:

Output: T1546.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: ### Response: T1546.005.


Instruction: List the MITRE techniques contained in the text.

Input: Trap Manual)(Citation:

Output: T1546.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trap Manual)(Citation: ### Response: T1546.005.


Instruction: List the MITRE techniques contained in the text.

Input: Cyberciti Trap Statements)

Output: T1546.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cyberciti Trap Statements) ### Response: T1546.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs.

Output: T1546.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. ### Response: T1546.007.


Instruction: List the MITRE techniques contained in the text.

Input: Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Output: T1546.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. ### Response: T1546.007.


Instruction: List the MITRE techniques contained in the text.

Input: It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh)

Output: T1546.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) ### Response: T1546.007.


Instruction: List the MITRE techniques contained in the text.

Input: The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.

Output: T1546.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh. ### Response: T1546.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner.

Output: T1546.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. ### Response: T1546.007.


Instruction: List the MITRE techniques contained in the text.

Input: This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)

Output: T1546.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence) ### Response: T1546.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: IFEOs enable a developer to attach a debugger to an application.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IFEOs enable a developer to attach a debugger to an application. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., <code>C:\dbg\ntsd.exe

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., <code>C:\dbg\ntsd.exe ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: -g  notepad.exe</code>).

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: -g  notepad.exe</code>). ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Dev Blog IFEO Mar 2010)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Dev Blog IFEO Mar 2010) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. ### Response: T1546.012.