Instruction: List the MITRE techniques contained in the text.

Input: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser.(Citation: BBC-malvertising)

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser.(Citation: BBC-malvertising) ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also employ several techniques to evade detection by the advertising network.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also employ several techniques to evade detection by the advertising network. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement.(Citation: Masquerads-Guardio) Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.(Citation: spamhaus-malvertising)

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement.(Citation: Masquerads-Guardio) Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.(Citation: spamhaus-malvertising) ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to find cloud groups and permission settings.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to find cloud groups and permission settings. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: With authenticated access there are several tools that can be used to find permissions groups.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With authenticated access there are several tools that can be used to find permissions groups. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: The Get-MsolRole

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Get-MsolRole ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation:

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub Raindance).

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub Raindance). ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation:

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft AZ CLI)(Citation:

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft AZ CLI)(Citation: ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation)

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL).

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to find domain-level groups and permission settings.

Output: T1069.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to find domain-level groups and permission settings. ### Response: T1069.002.


Instruction: List the MITRE techniques contained in the text.

Input: The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.

Output: T1069.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. ### Response: T1069.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Commands such as net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility,  dscacheutil -q

Output: T1069.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Commands such as net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility,  dscacheutil -q ### Response: T1069.002.


Instruction: List the MITRE techniques contained in the text.

Input: group on macOS, and ldapsearch on Linux can list domain-level groups.

Output: T1069.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: group on macOS, and ldapsearch on Linux can list domain-level groups. ### Response: T1069.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to find local system groups and permission settings.

Output: T1069.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to find local system groups and permission settings. ### Response: T1069.001.


Instruction: List the MITRE techniques contained in the text.

Input: The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.

Output: T1069.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. ### Response: T1069.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Output: T1069.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. ### Response: T1069.001.


Instruction: List the MITRE techniques contained in the text.

Input: Commands such as net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility, dscl .

Output: T1069.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands such as net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility, dscl . ### Response: T1069.001.


Instruction: List the MITRE techniques contained in the text.

Input: -list /Groups</code>

Output: T1069.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: -list /Groups</code> ### Response: T1069.001.


Instruction: List the MITRE techniques contained in the text.

Input: on macOS, and groups on Linux can list local groups.

Output: T1069.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: on macOS, and groups on Linux can list local groups. ### Response: T1069.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to discover group and permission settings.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to discover group and permission settings. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to discover group permission settings in many different ways.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to discover group permission settings in many different ways. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018) ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.

Output: T1114.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. ### Response: T1114.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network.

Output: T1114.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. ### Response: T1114.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens.

Output: T1114.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. ### Response: T1114.002.


Instruction: List the MITRE techniques contained in the text.

Input: Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.

Output: T1114.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords. ### Response: T1114.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may setup email forwarding rules to collect sensitive information.

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may setup email forwarding rules to collect sensitive information. ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018)

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules)

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient.

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: These rules may be created through a local email application, a web interface, or by command-line interface.

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These rules may be created through a local email application, a web interface, or by command-line interface. ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule.

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)

Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more.

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)

Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules)

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes.

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023)

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives.

Output: T1114.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives. ### Response: T1114.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target user email on local systems to collect sensitive information.

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target user email on local systems to collect sensitive information. ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook stores data locally in offline data files with an extension of .ost.

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook stores data locally in offline data files with an extension of .ost. ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes)

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files.

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)

Output: T1114.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files) ### Response: T1114.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target user email to collect sensitive information.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target user email to collect sensitive information. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can collect or forward email from mail servers or clients.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can collect or forward email from mail servers or clients. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Additional custom tools likely exist as well.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional custom tools likely exist as well. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input: The SAM is a database file that contains local accounts for the host, typically those found with the net user command.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The SAM is a database file that contains local accounts for the host, typically those found with the net user command. ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input: Enumerating the SAM database requires SYSTEM level access.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enumerating the SAM database requires SYSTEM level access. ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input:
A number of tools can be used to retrieve the SAM file through in-memory techniques:

* pwdumpx.exe
* [gsecdump](https://attack.mitre.org/software/S0008)
*

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A number of tools can be used to retrieve the SAM file through in-memory techniques:

* pwdumpx.exe
* [gsecdump](https://attack.mitre.org/software/S0008)
* ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Mimikatz](https://attack.mitre.org/software/S0002) ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input:
* secretsdump.py

Alternatively, the SAM can be extracted from the Registry with Reg:

* reg save HKLM\sam sam
* reg save HKLM\system system

Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation:

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * secretsdump.py

Alternatively, the SAM can be extracted from the Registry with Reg:

* reg save HKLM\sam sam
* reg save HKLM\system system

Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input:
GitHub Creddump7)

Notes:

*

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub Creddump7)

Notes:

* ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input: RID 500 account is the local, built-in administrator.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RID 500 account is the local, built-in administrator. ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input: * RID 501 is the guest account.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * RID 501 is the guest account. ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input: User accounts start with a RID of 1,000+.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: User accounts start with a RID of 1,000+. ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search freely available technical databases for information about victims that can be used during targeting.

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search freely available technical databases for information about victims that can be used during targeting. ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: DigitalShadows CDN)(Citation: Shodan)

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DigitalShadows CDN)(Citation: Shodan) ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search in different open databases depending on what information they seek to gather.

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search in different open databases depending on what information they seek to gather. ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search public WHOIS data for information about victims that can be used during targeting.

Output: T1596.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search public WHOIS data for information about victims that can be used during targeting. ### Response: T1596.002.


Instruction: List the MITRE techniques contained in the text.

Input: WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names.

Output: T1596.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. ### Response: T1596.002.


Instruction: List the MITRE techniques contained in the text.

Input: Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS)

Output: T1596.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS) ### Response: T1596.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search WHOIS data to gather actionable information.

Output: T1596.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search WHOIS data to gather actionable information. ### Response: T1596.002.


Instruction: List the MITRE techniques contained in the text.

Input: Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims.

Output: T1596.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. ### Response: T1596.002.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1596.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1596.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify system firmware to persist on systems.

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify system firmware to persist on systems. ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input: The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI)

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: About UEFI)

System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity.

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: About UEFI)

System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input: Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect. ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search websites owned by the victim for information that can be used during targeting.

Output: T1594

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search websites owned by the victim for information that can be used during targeting. ### Response: T1594.


Instruction: List the MITRE techniques contained in the text.

Input: Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)).

Output: T1594

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). ### Response: T1594.


Instruction: List the MITRE techniques contained in the text.

Input: These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak)

Output: T1594

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak) ### Response: T1594.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search victim-owned websites to gather actionable information.

Output: T1594

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search victim-owned websites to gather actionable information. ### Response: T1594.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)).

Output: T1594

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)). ### Response: T1594.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to discover group and permission settings.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to discover group and permission settings. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to discover group permission settings in many different ways.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to discover group permission settings in many different ways. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018) ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to find cloud groups and permission settings.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to find cloud groups and permission settings. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: With authenticated access there are several tools that can be used to find permissions groups.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With authenticated access there are several tools that can be used to find permissions groups. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: The Get-MsolRole

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Get-MsolRole ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation:

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub Raindance).

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub Raindance). ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation:

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft AZ CLI)(Citation:

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft AZ CLI)(Citation: ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation)

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL).

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.

Output: T1069.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object. ### Response: T1069.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: How the operating system locates libraries to be used by a program can also be intercepted.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: How the operating system locates libraries to be used by a program can also be intercepted. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services.

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe,  [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075).

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe,  [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: Access to Registry keys is controlled through access control lists and user permissions.

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access to Registry keys is controlled through access control lists and user permissions. ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Registry Key Security)(Citation: malware_hides_service)

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Registry Key Security)(Citation: malware_hides_service) ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control.

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also alter other Registry keys in the service’s Registry tree.

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also alter other Registry keys in the service’s Registry tree. ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness)

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: The Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree)

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms)

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms) ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also add the Parameters key, which stores driver-specific data, or other custom subkeys for their malicious services to establish persistence or enable other malicious activities.(Citation: microsoft_services_registry_tree)(Citation: troj_zegost)

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also add the Parameters key, which stores driver-specific data, or other custom subkeys for their malicious services to establish persistence or enable other malicious activities.(Citation: microsoft_services_registry_tree)(Citation: troj_zegost) ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, If adversaries launch their malicious services using svchost.exe, the service’s file may be identified using HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servicename\Parameters\ServiceDll.(Citation: malware_hides_service)

Output: T1574.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, If adversaries launch their malicious services using svchost.exe, the service’s file may be identified using HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servicename\Parameters\ServiceDll.(Citation: malware_hides_service) ### Response: T1574.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search freely available technical databases for information about victims that can be used during targeting.

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search freely available technical databases for information about victims that can be used during targeting. ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: DigitalShadows CDN)(Citation: Shodan)

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DigitalShadows CDN)(Citation: Shodan) ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search in different open databases depending on what information they seek to gather.

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search in different open databases depending on what information they seek to gather. ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search DNS data for information about victims that can be used during targeting.

Output: T1596.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search DNS data for information about victims that can be used during targeting. ### Response: T1596.001.


Instruction: List the MITRE techniques contained in the text.

Input: DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.

Output: T1596.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. ### Response: T1596.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search DNS data to gather actionable information.

Output: T1596.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search DNS data to gather actionable information. ### Response: T1596.001.


Instruction: List the MITRE techniques contained in the text.

Input: Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation:

Output: T1596.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation: ### Response: T1596.001.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)

Output: T1596.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS) ### Response: T1596.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks.

Output: T1596.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. ### Response: T1596.001.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1596.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1596.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Example services include websites, email services, DNS, and web-based applications.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example services include websites, email services, DNS, and web-based applications. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) ### Response: T1499.