Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)

Output: T1018

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021) ### Response: T1018.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

Output: T1046

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. ### Response: T1046.


Instruction: List the MITRE techniques contained in the text.

Input:
Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)

Within cloud environments, adversaries may attempt to discover services running on other cloud hosts.

Output: T1046

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)

Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. ### Response: T1046.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.

Output: T1046

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well. ### Response: T1046.


Instruction: List the MITRE techniques contained in the text.

Input: Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network.

Output: T1046

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. ### Response: T1046.


Instruction: List the MITRE techniques contained in the text.

Input: The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network.

Output: T1046

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. ### Response: T1046.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)

Output: T1046

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley) ### Response: T1046.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's networks that can be used during targeting.

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's networks that can be used during targeting. ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation:

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS) ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's network domain(s) that can be used during targeting.

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers. ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation:

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS) ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments.(Citation:

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments.(Citation: ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: Azure Active Directory Reconnaisance)(Citation: Office 265 Azure Domain Availability)

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Azure Active Directory Reconnaisance)(Citation: Office 265 Azure Domain Availability) ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).

Output: T1590.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)). ### Response: T1590.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Output: T1518.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. ### Response: T1518.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may include things such as firewall rules and anti-virus.

Output: T1518.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include things such as firewall rules and anti-virus. ### Response: T1518.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Output: T1518.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. ### Response: T1518.001.


Instruction: List the MITRE techniques contained in the text.

Input: Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.

Output: T1518.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. ### Response: T1518.001.


Instruction: List the MITRE techniques contained in the text.

Input: It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.

Output: T1518.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. ### Response: T1518.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS)

Output: T1518.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS) ### Response: T1518.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the permitted IP ranges, ports or user accounts for the inbound/outbound rules of security groups, virtual firewalls established within AWS for EC2 and/or VPC instances, can be revealed by the DescribeSecurityGroups action with various request parameters.

Output: T1518.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the permitted IP ranges, ports or user accounts for the inbound/outbound rules of security groups, virtual firewalls established within AWS for EC2 and/or VPC instances, can be revealed by the DescribeSecurityGroups action with various request parameters. ### Response: T1518.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: DescribeSecurityGroups - Amazon Elastic Compute Cloud)

Output: T1518.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: DescribeSecurityGroups - Amazon Elastic Compute Cloud) ### Response: T1518.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

Output: T1518

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. ### Response: T1518.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Output: T1518

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. ### Response: T1518.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).

Output: T1518

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068). ### Response: T1518.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features.

Output: T1538

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. ### Response: T1538.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)

Output: T1538

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard) ### Response: T1538.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API.

Output: T1538

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. ### Response: T1538.


Instruction: List the MITRE techniques contained in the text.

Input: This allows the adversary to gain information without making any API requests.

Output: T1538

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This allows the adversary to gain information without making any API requests. ### Response: T1538.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Process injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: These implementations exist for every major OS but are typically platform specific.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These implementations exist for every major OS but are typically platform specific. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.005.


Instruction: List the MITRE techniques contained in the text.

Input: TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TLS callback injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.005.


Instruction: List the MITRE techniques contained in the text.

Input: TLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point.

Output: T1055.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. ### Response: T1055.005.


Instruction: List the MITRE techniques contained in the text.

Input: TLS callbacks are normally used by the OS to setup and/or cleanup data used by threads.

Output: T1055.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TLS callbacks are normally used by the OS to setup and/or cleanup data used by threads. ### Response: T1055.005.


Instruction: List the MITRE techniques contained in the text.

Input: Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other [Process Injection](https://attack.mitre.org/techniques/T1055) techniques such as [Process Hollowing](https://attack.mitre.org/techniques/T1055/012).(Citation: FireEye TLS Nov 2017)

Output: T1055.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other [Process Injection](https://attack.mitre.org/techniques/T1055) techniques such as [Process Hollowing](https://attack.mitre.org/techniques/T1055/012).(Citation: FireEye TLS Nov 2017) ### Response: T1055.005.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.005.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various means to detect and avoid debuggers.

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various means to detect and avoid debuggers. ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.(Citation: ProcessHacker Github)

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.(Citation: ProcessHacker Github) ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment.

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497), if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497), if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant. ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: They may also search for debugger artifacts before dropping secondary or additional payloads.

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also search for debugger artifacts before dropping secondary or additional payloads. ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Specific checks will vary based on the target and/or adversary, but may involve [Native API](https://attack.mitre.org/techniques/T1106) function calls such as IsDebuggerPresent() and  NtQueryInformationProcess(), or manually checking the BeingDebugged flag of the Process Environment Block (PEB).

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific checks will vary based on the target and/or adversary, but may involve [Native API](https://attack.mitre.org/techniques/T1106) function calls such as IsDebuggerPresent() and  NtQueryInformationProcess(), or manually checking the BeingDebugged flag of the Process Environment Block (PEB). ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would “swallow” or handle the potential error).(Citation: hasherezade debug)(Citation:

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would “swallow” or handle the potential error).(Citation: hasherezade debug)(Citation: ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: AlKhaser Debug)(Citation: vxunderground debug)

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AlKhaser Debug)(Citation: vxunderground debug) ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors.

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors. ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping [Native API](https://attack.mitre.org/techniques/T1106) function calls such as OutputDebugStringW().(Citation: wardle evilquest partii)(Citation:

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping [Native API](https://attack.mitre.org/techniques/T1106) function calls such as OutputDebugStringW().(Citation: wardle evilquest partii)(Citation: ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Checkpoint Dridex Jan 2021)

Output: T1622

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Checkpoint Dridex Jan 2021) ### Response: T1622.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can hide a program's true filetype by changing the extension of a file.

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can hide a program's true filetype by changing the extension of a file. ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute.

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary).

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back). ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious. ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation:

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may achieve the same goal by modifying or extending features of the kernel.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may achieve the same goal by modifying or extending features of the kernel. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify plist files to automatically run an application when a user logs in.

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify plist files to automatically run an application when a user logs in. ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.(Citation: Methods of Mac Malware Persistence)(Citation:

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.(Citation: Methods of Mac Malware Persistence)(Citation: ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: Wardle Persistence Chapter)

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wardle Persistence Chapter) ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: Applications listed in this file are automatically reopened upon the user’s next logon.

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Applications listed in this file are automatically reopened upon the user’s next logon. ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the com.apple.loginwindow.[UUID].plist file to execute payloads when a user logs in.

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the com.apple.loginwindow.[UUID].plist file to execute payloads when a user logs in. ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input:
Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

*

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

* ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Proofpoint TA407 September 2019)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Proofpoint TA407 September 2019) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: DigiCert Install SSL Cert)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DigiCert Install SSL Cert) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims.

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input: Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation:

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation: ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input: Atlas SEO)(Citation:

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Atlas SEO)(Citation: ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input:
MalwareBytes SEO)

To help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)) within search engines.

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MalwareBytes SEO)

To help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)) within search engines. ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input: Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites.

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input: These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news).(Citation:

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news).(Citation: ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input: ZScaler SEO)(Citation: Atlas SEO)

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ZScaler SEO)(Citation: Atlas SEO) ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation.(Citation:

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation.(Citation: ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input:
MalwareBytes SEO)(Citation: DFIR Report Gootloader)

SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.(Citation: ZScaler SEO)(Citation: Sophos Gootloader)

Output: T1608.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MalwareBytes SEO)(Citation: DFIR Report Gootloader)

SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.(Citation: ZScaler SEO)(Citation: Sophos Gootloader) ### Response: T1608.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input:
Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Captured hashes are used with PtH to authenticate as that user.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Captured hashes are used with PtH to authenticate as that user. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Once authenticated, PtH may be used to perform actions on local or remote systems.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once authenticated, PtH may be used to perform actions on local or remote systems. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use stolen password hashes to "overpass the hash."

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use stolen password hashes to "overpass the hash." ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: attacks.(Citation: Stealthbits Overpass-the-Hash)

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: attacks.(Citation: Stealthbits Overpass-the-Hash) ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to exfiltrate data over a USB connected physical device.

Output: T1052.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to exfiltrate data over a USB connected physical device. ### Response: T1052.001.


Instruction: List the MITRE techniques contained in the text.

Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user.

Output: T1052.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. ### Response: T1052.001.


Instruction: List the MITRE techniques contained in the text.

Input: The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Output: T1052.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems. ### Response: T1052.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

Output: T1052

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. ### Response: T1052.


Instruction: List the MITRE techniques contained in the text.

Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user.

Output: T1052

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. ### Response: T1052.


Instruction: List the MITRE techniques contained in the text.

Input: Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device.

Output: T1052

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. ### Response: T1052.


Instruction: List the MITRE techniques contained in the text.

Input: The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Output: T1052

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems. ### Response: T1052.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: How the operating system locates libraries to be used by a program can also be intercepted.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: How the operating system locates libraries to be used by a program can also be intercepted. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by side-loading DLLs.

Output: T1574.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by side-loading DLLs. ### Response: T1574.002.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads.

Output: T1574.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. ### Response: T1574.002.


Instruction: List the MITRE techniques contained in the text.

Input: But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).

Output: T1574.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s). ### Response: T1574.002.


Instruction: List the MITRE techniques contained in the text.

Input: Side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other.

Output: T1574.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other. ### Response: T1574.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process.

Output: T1574.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. ### Response: T1574.002.


Instruction: List the MITRE techniques contained in the text.

Input: Benign executables used to side-load payloads may not be flagged during delivery and/or execution.

Output: T1574.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Benign executables used to side-load payloads may not be flagged during delivery and/or execution. ### Response: T1574.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.(Citation: FireEye DLL Side-Loading)

Output: T1574.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.(Citation: FireEye DLL Side-Loading) ### Response: T1574.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may transfer tools or other files from an external system into a compromised environment.

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may transfer tools or other files from an external system into a compromised environment. ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095).

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)).

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)). ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as <code>IEX(New-Object Net.

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as <code>IEX(New-Object Net. ### Response: T1105.