Instruction: List the MITRE techniques contained in the text.

Input: Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input:
Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

*

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

* ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Proofpoint TA407 September 2019)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Proofpoint TA407 September 2019) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: DigiCert Install SSL Cert)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DigiCert Install SSL Cert) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing.

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001).

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site.

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input:
This may be done in a number of ways, including:

*

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be done in a number of ways, including:

* ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Inserting malicious scripts into web pages or other user controllable web content such as forum posts
*

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Inserting malicious scripts into web pages or other user controllable web content such as forum posts
* ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Modifying script files served to websites from publicly writeable cloud storage buckets
* Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., [Malvertising](https://attack.mitre.org/techniques/T1583/008))

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifying script files served to websites from publicly writeable cloud storage buckets
* Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., [Malvertising](https://attack.mitre.org/techniques/T1583/008)) ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation:

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input:
ATT ScanBox)

Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest.

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ATT ScanBox)

Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: This kind of targeted campaign is referred to a strategic web compromise or watering hole attack.

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.)

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).

Output: T1608.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). ### Response: T1608.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may try to gather information about registered local system services.

Output: T1007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may try to gather information about registered local system services. ### Response: T1007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start.

Output: T1007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. ### Response: T1007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Output: T1007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. ### Response: T1007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Defense Evasion activities.

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Defense Evasion activities. ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines.

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP)

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)(Citation:

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)(Citation: ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: SpecterOps AWS Traffic Mirroring)

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SpecterOps AWS Traffic Mirroring) ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring) ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: On network devices, adversaries may perform network captures using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `monitor capture`.(Citation: US-CERT-TA18-106A)(Citation: capture_embedded_packet_on_software)

Output: T1040

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On network devices, adversaries may perform network captures using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `monitor capture`.(Citation: US-CERT-TA18-106A)(Citation: capture_embedded_packet_on_software) ### Response: T1040.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators.

Output: T1017

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators. ### Response: T1017.


Instruction: List the MITRE techniques contained in the text.

Input: The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required.

Output: T1017

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required. ### Response: T1017.


Instruction: List the MITRE techniques contained in the text.

Input: However, the system may require an administrative account to log in or to perform software deployment.

Output: T1017

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, the system may require an administrative account to log in or to perform software deployment. ### Response: T1017.


Instruction: List the MITRE techniques contained in the text.

Input: Access to a network-wide or enterprise-wide software deployment system enables an adversary to have remote code execution on all systems that are connected to such a system.

Output: T1017

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access to a network-wide or enterprise-wide software deployment system enables an adversary to have remote code execution on all systems that are connected to such a system. ### Response: T1017.


Instruction: List the MITRE techniques contained in the text.

Input: The access may be used to laterally move to systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.

Output: T1017

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The access may be used to laterally move to systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints. ### Response: T1017.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to subvert these trust mechanisms.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to subvert these trust mechanisms. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: The method adversaries use will depend on the specific mechanism they seek to subvert.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The method adversaries use will depend on the specific mechanism they seek to subvert. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017)

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates)

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates) ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia Code Signing)

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia Code Signing) ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input: The certificates used during an operation may be created, acquired, or stolen by the adversary.

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The certificates used during an operation may be created, acquired, or stolen by the adversary. ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates)

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input: Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature.

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing to verify software on first run can be used on modern Windows and macOS systems.

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing to verify software on first run can be used on modern Windows and macOS systems. ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input: It is not used on Linux due to the decentralized nature of the platform.

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is not used on Linux due to the decentralized nature of the platform. ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning)

Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

Output: T1553.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning)

Code signing certificates may be used to bypass security policies that require signed code to execute on a system. ### Response: T1553.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may access data from cloud storage.

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may access data from cloud storage. ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage.

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform.

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the [Cloud API](https://attack.mitre.org/techniques/T1059/009).

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the [Cloud API](https://attack.mitre.org/techniques/T1059/009). ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., [Data from Information Repositories](https://attack.mitre.org/techniques/T1213)).

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., [Data from Information Repositories](https://attack.mitre.org/techniques/T1213)). ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may collect sensitive data from these cloud storage solutions.

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may collect sensitive data from these cloud storage solutions. ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation:

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Azure Storage Security, 2019)(Citation:

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Azure Storage Security, 2019)(Citation: ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Google Cloud Storage Best Practices, 2019)

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Google Cloud Storage Best Practices, 2019) ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions. ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation:

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Wired Magecart S3 Buckets, 2019)(Citation:

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wired Magecart S3 Buckets, 2019)(Citation: ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021)

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021) ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects.

Output: T1530

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects. ### Response: T1530.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may alter application binaries used to display data in order to cause runtime manipulations.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may alter application binaries used to display data in order to cause runtime manipulations. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials.

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials. ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)). ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search the Registry on compromised systems for insecurely stored credentials.

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search the Registry on compromised systems for insecurely stored credentials. ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Registry stores configuration information that can be used by the system or other programs.

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Registry stores configuration information that can be used by the system or other programs. ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services.

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes these credentials are used for automatic logons.

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes these credentials are used for automatic logons. ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

* Local Machine Hive: <code>reg query HKLM /f password /t

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

* Local Machine Hive: <code>reg query HKLM /f password /t ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input:
REG_SZ /s</code>
*

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: REG_SZ /s</code>
* ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: Current User Hive: <code>reg query HKCU /f

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Current User Hive: <code>reg query HKCU /f ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: password /t

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: password /t ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: REG_SZ /s</code>

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: REG_SZ /s</code> ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

Output: T1135

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. ### Response: T1135.


Instruction: List the MITRE techniques contained in the text.

Input: Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

Output: T1135

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. ### Response: T1135.


Instruction: List the MITRE techniques contained in the text.

Input: File sharing over a Windows network occurs over the SMB protocol.

Output: T1135

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File sharing over a Windows network occurs over the SMB protocol. ### Response: T1135.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder)

Output: T1135

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) ### Response: T1135.


Instruction: List the MITRE techniques contained in the text.

Input: [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\remotesystem command.

Output: T1135

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. ### Response: T1135.


Instruction: List the MITRE techniques contained in the text.

Input: It can also be used to query shared drives on the local system using net share.

Output: T1135

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It can also be used to query shared drives on the local system using net share. ### Response: T1135.


Instruction: List the MITRE techniques contained in the text.

Input: For macOS, the sharing -l command lists all shared points used for smb services.

Output: T1135

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For macOS, the sharing -l command lists all shared points used for smb services. ### Response: T1135.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS)

Output: T1120

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) ### Response: T1120.


Instruction: List the MITRE techniques contained in the text.

Input: Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage.

Output: T1120

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. ### Response: T1120.


Instruction: List the MITRE techniques contained in the text.

Input: The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Output: T1120

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The information may be used to enhance their awareness of the system and network environment or may be used for further actions. ### Response: T1120.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity.

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022)

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree.

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit.

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree.

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation:

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: Sandfly BPFDoor 2022)(Citation:

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sandfly BPFDoor 2022)(Citation: ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft XorDdos Linux Stealth 2022)

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft XorDdos Linux Stealth 2022) ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's networks that can be used during targeting.

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's networks that can be used during targeting. ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation:

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS) ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's network topology that can be used during targeting.

Output: T1590.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's network topology that can be used during targeting. ### Response: T1590.004.


Instruction: List the MITRE techniques contained in the text.

Input: Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments.

Output: T1590.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. ### Response: T1590.004.


Instruction: List the MITRE techniques contained in the text.

Input: This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure.

Output: T1590.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. ### Response: T1590.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1590.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1590.004.


Instruction: List the MITRE techniques contained in the text.

Input: Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster)

Output: T1590.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster) ### Response: T1590.004.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1590.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1590.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1590.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1590.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may build capabilities that can be used during targeting.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may build capabilities that can be used during targeting. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Talos Promethium June 2020)

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos Promethium June 2020) ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: As with legitimate development efforts, different skill sets may be required for developing capabilities.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with legitimate development efforts, different skill sets may be required for developing capabilities. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: The skills needed may be located in-house, or may need to be contracted out.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The skills needed may be located in-house, or may need to be contracted out. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create self-signed code signing certificates that can be used during targeting.

Output: T1587.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create self-signed code signing certificates that can be used during targeting. ### Response: T1587.002.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted.

Output: T1587.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. ### Response: T1587.002.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.

Output: T1587.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. ### Response: T1587.002.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.

Output: T1587.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations. ### Response: T1587.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018)

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions.

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions.

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: This may enable malicious activity such as modifying, replacing, or deleting specific files or directories.

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. ### Response: T1222.