Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Process injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: These implementations exist for every major OS but are typically platform specific.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These implementations exist for every major OS but are typically platform specific. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: EWM injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: EWM injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation:

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Window Classes)

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Window Classes) ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function) ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Execution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation:

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Elastic Process Injection July 2017)

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Elastic Process Injection July 2017) ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013) ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation:

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Task Scheduler Security)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet Task Scheduler Security) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: There are multiple ways to access the Task Scheduler in Windows.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are multiple ways to access the Task Scheduler in Windows. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM).

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent)

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent) ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task)

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments)

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments) ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: The observation of the signal packets to trigger the communication can be conducted through different methods.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The observation of the signal packets to trigger the communication can be conducted through different methods. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.(Citation:

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.(Citation: ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Cisco Synful Knock Evolution)(Citation: Mandiant - Synful Knock)(Citation: Cisco Blog Legacy Device Attacks)

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cisco Synful Knock Evolution)(Citation: Mandiant - Synful Knock)(Citation: Cisco Blog Legacy Device Attacks) ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use the Wake-on-LAN feature to turn on powered off systems.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation: AMD Magic Packet)

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation: AMD Magic Packet) ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control.

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket.

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: The filter may apply to all traffic passing through the specified network interface (or every interface if not specified).

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell.

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell. ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: To establish a connection, an adversary sends a crafted packet to the targeted host that matches the installed filter criteria.(Citation: haking9 libpcap network sniffing)

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To establish a connection, an adversary sends a crafted packet to the targeted host that matches the installed filter criteria.(Citation: haking9 libpcap network sniffing) ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have used these socket filters to trigger the installation of implants, conduct ping backs, and to invoke command shells.

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have used these socket filters to trigger the installation of implants, conduct ping backs, and to invoke command shells. ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: Communication with these socket filters may also be used in conjunction with [Protocol Tunneling](https://attack.mitre.org/techniques/T1572).(Citation: exatrack bpf filters passive backdoors)(Citation:

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Communication with these socket filters may also be used in conjunction with [Protocol Tunneling](https://attack.mitre.org/techniques/T1572).(Citation: exatrack bpf filters passive backdoors)(Citation: ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: Leonardo Turla Penquin May 2020)

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Leonardo Turla Penquin May 2020) ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: Filters can be installed on any Unix-like platform with `libpcap` installed or on Windows hosts using `Winpcap`.

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Filters can be installed on any Unix-like platform with `libpcap` installed or on Windows hosts using `Winpcap`. ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use either `libpcap` with `pcap_setfilter` or the standard library function `setsockopt` with `SO_ATTACH_FILTER` options.

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use either `libpcap` with `pcap_setfilter` or the standard library function `setsockopt` with `SO_ATTACH_FILTER` options. ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: Since the socket connection is not active until the packet is received, this behavior may be difficult to detect due to the lack of activity on a host, low CPU overhead, and limited visibility into raw socket usage.

Output: T1205.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the socket connection is not active until the packet is received, this behavior may be difficult to detect due to the lack of activity on a host, low CPU overhead, and limited visibility into raw socket usage. ### Response: T1205.002.


Instruction: List the MITRE techniques contained in the text.

Input: If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.

Output: T1066

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. ### Response: T1066.


Instruction: List the MITRE techniques contained in the text.

Input: A good example of this is when malware is detected with a file signature and quarantined by anti-virus software.

Output: T1066

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. ### Response: T1066.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary who can determine that the malware was quarantined because of its file signature may use [Software Packing](https://attack.mitre.org/techniques/T1045) or otherwise modify the file so it has a different signature, and then re-use the malware.

Output: T1066

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary who can determine that the malware was quarantined because of its file signature may use [Software Packing](https://attack.mitre.org/techniques/T1045) or otherwise modify the file so it has a different signature, and then re-use the malware. ### Response: T1066.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may compress and/or encrypt data that is collected prior to exfiltration.

Output: T1560

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may compress and/or encrypt data that is collected prior to exfiltration. ### Response: T1560.


Instruction: List the MITRE techniques contained in the text.

Input: Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.

Output: T1560

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. ### Response: T1560.


Instruction: List the MITRE techniques contained in the text.

Input: Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Output: T1560

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. ### Response: T1560.


Instruction: List the MITRE techniques contained in the text.

Input: Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

Output: T1560

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method. ### Response: T1560.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse various utilities to compress or encrypt data before exfiltration. ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems. ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows, diantz or

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows, diantz or  ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: makecab</code> may be used to package collected files into a cabinet (.cab) file.

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: makecab</code> may be used to package collected files into a cabinet (.cab) file. ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: diantz may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) xcopy on Windows can copy files and directories with a variety of options.

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: diantz may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) xcopy on Windows can copy files and directories with a variety of options. ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration.

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)

Output: T1560.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage) ### Response: T1560.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary may then perform actions as the logged-on user.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary may then perform actions as the logged-on user. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: In an enterprise environment, servers and workstations can be organized into domains.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In an enterprise environment, servers and workstations can be organized into domains. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Management MDM macOS)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Management MDM macOS)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Kickstart Apple Remote Desktop commands)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kickstart Apple Remote Desktop commands)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Apple Remote Desktop Admin Guide 3.3)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple Remote Desktop Admin Guide 3.3) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Lockboxx ARD 2019)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Lockboxx ARD 2019)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Kickstart Apple Remote Desktop commands)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kickstart Apple Remote Desktop commands) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC).

Output: T1021.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). ### Response: T1021.005.


Instruction: List the MITRE techniques contained in the text.

Input: VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol)

Output: T1021.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol) ### Response: T1021.005.


Instruction: List the MITRE techniques contained in the text.

Input: VNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software.

Output: T1021.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: VNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software. ### Response: T1021.005.


Instruction: List the MITRE techniques contained in the text.

Input: By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication)

Output: T1021.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication) ### Response: T1021.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands.

Output: T1021.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. ### Response: T1021.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network.

Output: T1021.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. ### Response: T1021.005.


Instruction: List the MITRE techniques contained in the text.

Input: Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.(Citation: Hijacking VNC)(Citation: macOS root VNC login without authentication)(Citation: VNC Vulnerabilities)(Citation: Offensive Security VNC Authentication Check)(Citation: Attacking VNC Servers PentestLab)(Citation:

Output: T1021.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.(Citation: Hijacking VNC)(Citation: macOS root VNC login without authentication)(Citation: VNC Vulnerabilities)(Citation: Offensive Security VNC Authentication Check)(Citation: Attacking VNC Servers PentestLab)(Citation: ### Response: T1021.005.


Instruction: List the MITRE techniques contained in the text.

Input: Havana authentication bug)

Output: T1021.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Havana authentication bug) ### Response: T1021.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: WMI is an administration feature that provides a uniform environment to access Windows system components.

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: WMI is an administration feature that provides a uniform environment to access Windows system components. ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: The WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM) and [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) (WinRM).(Citation: MSDN WMI)

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM) and [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) (WinRM).(Citation: MSDN WMI) ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation:

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation: ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: MSDN WMI)(Citation:

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MSDN WMI)(Citation: ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye WMI 2015)

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye WMI 2015) ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as remote Execution of files as part of Lateral Movement.

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as remote Execution of files as part of Lateral Movement. ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye WMI SANS 2015)

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye WMI SANS 2015) ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye WMI 2015)

Output: T1047

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye WMI 2015) ### Response: T1047.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: User shells execute several configuration scripts at different points throughout the session based on events.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: User shells execute several configuration scripts at different points throughout the session based on events. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: For example, when a user opens a command line interface or remotely logs in (such as SSH) a login shell is initiated.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, when a user opens a command line interface or remotely logs in (such as SSH) a login shell is initiated. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: All login shells on a system use <code>/etc/profile</code> when initiated.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All login shells on a system use <code>/etc/profile</code> when initiated. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files (Citation: intezer-kaiji-malware).

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files (Citation: intezer-kaiji-malware). ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: These files require root permissions and are executed each time any shell on a system launches.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These files require root permissions and are executed each time any shell on a system launches. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile (Rocke) which are sourced when a user opens a command line interface or connects remotely.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile (Rocke) which are sourced when a user opens a command line interface or connects remotely. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries often use ~/.bash_profile since the system only executes the first file that exists in the listed order.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries often use ~/.bash_profile since the system only executes the first file that exists in the listed order. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have also leveraged the <code>~/.bashrc</code> file (Tsunami, Rocke, Linux Rabbit, Magento) which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command line interface.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have also leveraged the <code>~/.bashrc</code> file (Tsunami, Rocke, Linux Rabbit, Magento) which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command line interface. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: Some malware targets the termination of a program to trigger execution (Cannon), adversaries can use the <code>~/.bash_logout</code> file to execute malicious commands at the end of a session(Pearl_shellbot).

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some malware targets the termination of a program to trigger execution (Cannon), adversaries can use the <code>~/.bash_logout</code> file to execute malicious commands at the end of a session(Pearl_shellbot). ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: For macOS, the functionality of this technique is similar but leverages zsh, the default shell for macOS 10.15+.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For macOS, the functionality of this technique is similar but leverages zsh, the default shell for macOS 10.15+. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: The login shell then configures the user environment with ~/.zprofile and ~/.zlogin.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: The interactive shell uses the <code>~/.zshrc<code> to configure the user environment.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The interactive shell uses the <code>~/.zshrc<code> to configure the user environment. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: Upon exiting, /etc/zlogout and ~/.zlogout are executed.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Upon exiting, /etc/zlogout and ~/.zlogout are executed. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: For legacy programs, macOS executes <code>/etc/bashrc</code> on startup.

Output: T1156

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For legacy programs, macOS executes <code>/etc/bashrc</code> on startup. ### Response: T1156.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.

Output: T1113

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. ### Response: T1113.


Instruction: List the MITRE techniques contained in the text.

Input: Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations.

Output: T1113

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. ### Response: T1113.


Instruction: List the MITRE techniques contained in the text.

Input: Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation:

Output: T1113

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: ### Response: T1113.


Instruction: List the MITRE techniques contained in the text.

Input: CopyFromScreen .NET)(Citation:

Output: T1113

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CopyFromScreen .NET)(Citation: ### Response: T1113.


Instruction: List the MITRE techniques contained in the text.

Input: Antiquated Mac Malware)

Output: T1113

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Antiquated Mac Malware) ### Response: T1113.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: This is common behavior that can be used across different platforms and the network to evade defenses.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is common behavior that can be used across different platforms and the network to evade defenses. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may be compressed, archived, or encrypted in order to avoid detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may be compressed, archived, or encrypted in order to avoid detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: These payloads may be used during Initial Access or later to mitigate detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These payloads may be used during Initial Access or later to mitigate detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Volexity PowerDuke November 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Volexity PowerDuke November 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use compressed or archived scripts, such as JavaScript.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use compressed or archived scripts, such as JavaScript. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Linux/Cdorked.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Linux/Cdorked. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: A We Live Security Analysis)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A We Live Security Analysis) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Obfuscation Sept 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Obfuscation Sept 2016) ### Response: T1027.