Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Obfuscation June 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Obfuscation June 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses.

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Fileless storage can be broadly defined as any format other than a file.

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Fileless storage can be broadly defined as any format other than a file. ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation:

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft Fileless)(Citation: SecureList Fileless)

Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620)

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Fileless)(Citation: SecureList Fileless)

Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: and [Process Injection](https://attack.mitre.org/techniques/T1055)

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: and [Process Injection](https://attack.mitre.org/techniques/T1055) ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: , fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage.

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: , fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage. ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)).

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored.

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored. ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless)

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless) ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR).

Output: T1067

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). ### Response: T1067.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MTrends 2016)

Output: T1067

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MTrends 2016) ### Response: T1067.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use bootkits to persist on systems at a layer below the operating system, which may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

Output: T1067

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use bootkits to persist on systems at a layer below the operating system, which may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. ### Response: T1067.


Instruction: List the MITRE techniques contained in the text.

Input:
### Master Boot Record
The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS.

Output: T1067

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ### Master Boot Record
The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. ### Response: T1067.


Instruction: List the MITRE techniques contained in the text.

Input: It is the location of the boot loader.

Output: T1067

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is the location of the boot loader. ### Response: T1067.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.

Output: T1067

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. ### Response: T1067.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Lau 2011)

### Volume Boot Record
The MBR passes control of the boot process to the VBR.

Output: T1067

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Lau 2011)

### Volume Boot Record
The MBR passes control of the boot process to the VBR. ### Response: T1067.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.

Output: T1067

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code. ### Response: T1067.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: These files allow system administrators to map and start custom services at startup for different run levels.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These files allow system administrators to map and start custom services at startup for different run levels. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: RC scripts require root privileges to modify.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RC scripts require root privileges to modify. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation:

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: Intezer HiddenWasp Map 2019)

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Intezer HiddenWasp Map 2019) ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: Upon reboot, the system executes the script's contents as root, resulting in persistence.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Upon reboot, the system executes the script's contents as root, resulting in persistence. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware)

Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware)

Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004).

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004). ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items)

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc) ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts)

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Registry key.(Citation: Hexacorn Logon Scripts)

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry key.(Citation: Hexacorn Logon Scripts) ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use these scripts to maintain persistence on a single system.

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use these scripts to maintain persistence on a single system. ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence.

Output: T1037.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. ### Response: T1037.003.


Instruction: List the MITRE techniques contained in the text.

Input: Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation:

Output: T1037.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: ### Response: T1037.003.


Instruction: List the MITRE techniques contained in the text.

Input: Petri Logon Script AD)

Output: T1037.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Petri Logon Script AD) ### Response: T1037.003.


Instruction: List the MITRE techniques contained in the text.

Input: These logon scripts run with the privileges of the user they are assigned to.

Output: T1037.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These logon scripts run with the privileges of the user they are assigned to. ### Response: T1037.003.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems.

Output: T1037.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. ### Response: T1037.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use these scripts to maintain persistence on a network.

Output: T1037.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use these scripts to maintain persistence on a network. ### Response: T1037.003.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Output: T1037.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ### Response: T1037.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use startup items automatically executed at boot initialization to establish persistence.

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use startup items automatically executed at boot initialization to establish persistence. ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items)

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra.

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory. ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence)

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user. ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use a Login Hook to establish persistence executed upon user logon.

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use a Login Hook to establish persistence executed upon user logon. ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: A login hook is a plist file that points to a specific script to execute with root privileges upon user logon.

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility.

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is the same for logout hooks where a script can be executed upon user logout.

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is the same for logout hooks where a script can be executed upon user logout. ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev)

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair.

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: The malicious script is executed upon the next user login.

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The malicious script is executed upon the next user login. ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: If a login hook already exists, adversaries can add additional commands to an existing login hook.

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a login hook already exists, adversaries can add additional commands to an existing login hook. ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation:

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: Wardle Persistence Chapter)

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wardle Persistence Chapter) ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)

Output: T1037.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) ### Response: T1037.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: These scripts can vary based on operating system and whether applied locally or remotely.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These scripts can vary based on operating system and whether applied locally or remotely. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use these scripts to maintain persistence on a single system.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use these scripts to maintain persistence on a single system. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131)

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input:
The typical server-client interaction is as follows:

1.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The typical server-client interaction is as follows:

1. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: The client broadcasts a `DISCOVER` message.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The client broadcasts a `DISCOVER` message. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 2. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: The server responds with an `OFFER` message, which includes an available network address.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The server responds with an `OFFER` message, which includes an available network address. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 3. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: The client broadcasts a `REQUEST` message, which includes the network address offered.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The client broadcasts a `REQUEST` message, which includes the network address offered. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 4. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: The server acknowledges with an `ACK` message and the client receives the network configuration parameters.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The server acknowledges with an `ACK` message and the client receives the network configuration parameters. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g)

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002))

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.(Citation: RFC826 ARP)

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.(Citation: RFC826 ARP) ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: Devices in a local network segment communicate with each other by using link layer addresses.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Devices in a local network segment communicate with each other by using link layer addresses. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: The device with the associated IP address directly replies with its MAC address.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The device with the associated IP address directly replies with its MAC address. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: The networked device that made the ARP request will then use as well as store that information in its ARP cache.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The networked device that made the ARP request will then use as well as store that information in its ARP cache. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: The ARP protocol is stateless and does not require authentication.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The ARP protocol is stateless and does not require authentication. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.(Citation: Sans ARP Spoofing Aug 2003)(Citation:

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.(Citation: Sans ARP Spoofing Aug 2003)(Citation: ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: Cylance Cleaver)

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cylance Cleaver) ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use ARP cache poisoning as a means to intercept network traffic.

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use ARP cache poisoning as a means to intercept network traffic. ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.(Citation:

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.(Citation: ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: Sans ARP Spoofing Aug 2003)

Output: T1557.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sans ARP Spoofing Aug 2003) ### Response: T1557.002.


Instruction: List the MITRE techniques contained in the text.

Input: By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may be used to collect or relay authentication materials.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may be used to collect or relay authentication materials. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: NBT-NS identifies systems on a local network by their NetBIOS name.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NBT-NS identifies systems on a local network by their NetBIOS name. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia LLMNR)(Citation: TechNet NetBIOS)

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia LLMNR)(Citation: TechNet NetBIOS) ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through [Network Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to obtain the plaintext passwords.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through [Network Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to obtain the plaintext passwords. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv1/v2 hashes can be intercepted and relayed to access and execute code against a target system.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv1/v2 hashes can be intercepted and relayed to access and execute code against a target system. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: The relay step can happen in conjunction with poisoning but may also be independent of it.(Citation: byt3bl33d3r NTLM Relaying)(Citation: Secure Ideas SMB Relay)

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The relay step can happen in conjunction with poisoning but may also be independent of it.(Citation: byt3bl33d3r NTLM Relaying)(Citation: Secure Ideas SMB Relay) ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various protocols, such as LDAP, SMB, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response.

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various protocols, such as LDAP, SMB, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response. ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174).(Citation:

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174).(Citation: ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub NBNSpoof)(Citation: Rapid7

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub NBNSpoof)(Citation: Rapid7 ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: LLMNR Spoofer)(Citation: GitHub Responder)

Output: T1557.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: LLMNR Spoofer)(Citation: GitHub Responder) ### Response: T1557.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040),

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)).

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics) ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner)

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW)

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW) ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att) ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498).

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498). ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs.

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: Various utilities and commands may acquire this information, including whoami.

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various utilities and commands may acquire this information, including whoami. ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: In macOS and Linux, the currently logged in user can be identified with w and who.

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In macOS and Linux, the currently logged in user can be identified with w and who. ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: On macOS the <code>dscl .

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On macOS the <code>dscl . ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: list /Users | grep -v '_'</code> command can also be used to enumerate user accounts.

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: list /Users | grep -v '_'</code> command can also be used to enumerate user accounts. ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: Environment variables, such as %USERNAME% and $USER, may also be used to access this information.

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environment variables, such as %USERNAME% and $USER, may also be used to access this information. ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show users` and `show ssh` can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)

Output: T1033

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show users` and `show ssh` can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018) ### Response: T1033.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase online advertisements that can be abused to distribute malware to victims.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: Ads can be purchased to plant as well as favorably position artifacts in specific locations  online, such as prominently placed within search engine results.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Ads can be purchased to plant as well as favorably position artifacts in specific locations  online, such as prominently placed within search engine results. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: Purchased ads may attempt to impersonate or spoof well-known brands.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Purchased ads may attempt to impersonate or spoof well-known brands. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software.(Citation: Masquerads-Guardio)(Citation: FBI-search) Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts.(Citation: sentinelone-malvertising)

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software.(Citation: Masquerads-Guardio)(Citation: FBI-search) Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts.(Citation: sentinelone-malvertising) ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: Malvertising may be used to support [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) and

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malvertising may be used to support [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) and ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser.(Citation: BBC-malvertising)

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser.(Citation: BBC-malvertising) ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also employ several techniques to evade detection by the advertising network.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also employ several techniques to evade detection by the advertising network. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages.

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement.(Citation: Masquerads-Guardio) Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.(Citation: spamhaus-malvertising)

Output: T1583.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement.(Citation: Masquerads-Guardio) Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.(Citation: spamhaus-malvertising) ### Response: T1583.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire domains that can be used during targeting.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire domains that can be used during targeting. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Domain names are the human readable names used to represent one or more IP addresses.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain names are the human readable names used to represent one or more IP addresses. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: They can be purchased or, in some cases, acquired for free.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They can be purchased or, in some cases, acquired for free. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. ### Response: T1583.001.