Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Output: T1573.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. ### Response: T1573.002.


Instruction: List the MITRE techniques contained in the text.

Input: Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private.

Output: T1573.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. ### Response: T1573.002.


Instruction: List the MITRE techniques contained in the text.

Input: Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key.

Output: T1573.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. ### Response: T1573.002.


Instruction: List the MITRE techniques contained in the text.

Input: This ensures that only the intended recipient can read the encrypted data.

Output: T1573.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This ensures that only the intended recipient can read the encrypted data. ### Response: T1573.002.


Instruction: List the MITRE techniques contained in the text.

Input: Common public key encryption algorithms include RSA and ElGamal.

Output: T1573.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common public key encryption algorithms include RSA and ElGamal. ### Response: T1573.002.


Instruction: List the MITRE techniques contained in the text.

Input: For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key.

Output: T1573.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. ### Response: T1573.002.


Instruction: List the MITRE techniques contained in the text.

Input: As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).

Output: T1573.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002). ### Response: T1573.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Firewall rules may also already exist to permit traffic to these services.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Firewall rules may also already exist to permit traffic to these services. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

Output: T1567.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. ### Response: T1567.002.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Output: T1567.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. ### Response: T1567.002.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of cloud storage services include Dropbox and Google Docs.

Output: T1567.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of cloud storage services include Dropbox and Google Docs. ### Response: T1567.002.


Instruction: List the MITRE techniques contained in the text.

Input: Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

Output: T1567.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service. ### Response: T1567.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may transfer tools or other files between systems in a compromised environment.

Output: T1570

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may transfer tools or other files between systems in a compromised environment. ### Response: T1570.


Instruction: List the MITRE techniques contained in the text.

Input: Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105))

Output: T1570

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) ### Response: T1570.


Instruction: List the MITRE techniques contained in the text.

Input: files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.

Output: T1570

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. ### Response: T1570.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019)

Output: T1570

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019) ### Response: T1570.


Instruction: List the MITRE techniques contained in the text.

Input: Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095).

Output: T1570

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095). ### Response: T1570.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries may be able to leverage [Web Service](https://attack.mitre.org/techniques/T1102)s such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation:

Output: T1570

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries may be able to leverage [Web Service](https://attack.mitre.org/techniques/T1102)s such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation: ### Response: T1570.


Instruction: List the MITRE techniques contained in the text.

Input: Dropbox Malware Sync)

Output: T1570

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dropbox Malware Sync) ### Response: T1570.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: How the operating system locates libraries to be used by a program can also be intercepted.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: How the operating system locates libraries to be used by a program can also be intercepted. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.

Output: T1574.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. ### Response: T1574.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Output: T1574.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch. ### Response: T1574.009.


Instruction: List the MITRE techniques contained in the text.

Input: Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe").

Output: T1574.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). ### Response: T1574.009.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Help eliminate unquoted path) (stored in Windows Registry keys)

Output: T1574.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) ### Response: T1574.009.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable.

Output: T1574.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. ### Response: T1574.009.


Instruction: List the MITRE techniques contained in the text.

Input: For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program.

Output: T1574.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. ### Response: T1574.009.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)

Output: T1574.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide) ### Response: T1574.009.


Instruction: List the MITRE techniques contained in the text.

Input: This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

Output: T1574.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process. ### Response: T1574.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input:
Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

*

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

* ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Proofpoint TA407 September 2019)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Proofpoint TA407 September 2019) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation:

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: DigiCert Install SSL Cert)

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DigiCert Install SSL Cert) ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install SSL/TLS certificates that can be used during targeting.

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install SSL/TLS certificates that can be used during targeting. ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems.

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct.

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner.

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert)

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert) ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or lending credibility to a credential harvesting site.

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or lending credibility to a credential harvesting site. ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: Installation of digital certificates may take place for a number of server types, including web servers and email servers.

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Installation of digital certificates may take place for a number of server types, including web servers and email servers. ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can obtain digital certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) or create self-signed certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1587/003)).

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can obtain digital certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) or create self-signed certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1587/003)). ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).

Output: T1608.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). ### Response: T1608.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd.

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH). ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input:
### cron

System-wide cron jobs are installed by modifying /etc/crontab file, /etc/cron.d/ directory or other locations supported by the Cron daemon, while per-user cron jobs are installed using crontab with specifically formatted crontab files.

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ### cron

System-wide cron jobs are installed by modifying /etc/crontab file, /etc/cron.d/ directory or other locations supported by the Cron daemon, while per-user cron jobs are installed using crontab with specifically formatted crontab files. ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppleDocs Scheduling Timed Jobs)

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AppleDocs Scheduling Timed Jobs) ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input: This works on macOS and Linux systems.

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This works on macOS and Linux systems. ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input: Those methods allow for commands or scripts to be executed at specific, periodic intervals in the background without user interaction.

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Those methods allow for commands or scripts to be executed at specific, periodic intervals in the background without user interaction. ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use job scheduling to execute programs at system startup or on a scheduled basis for Persistence, (Citation: Janicab) (Citation: Methods of Mac Malware Persistence) (Citation: Malware Persistence on OS X) (Citation: Avast Linux Trojan Cron Persistence) to conduct Execution as part of Lateral Movement, to gain root privileges, or to run a process under the context of a specific account.

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use job scheduling to execute programs at system startup or on a scheduled basis for Persistence, (Citation: Janicab) (Citation: Methods of Mac Malware Persistence) (Citation: Malware Persistence on OS X) (Citation: Avast Linux Trojan Cron Persistence) to conduct Execution as part of Lateral Movement, to gain root privileges, or to run a process under the context of a specific account. ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input:
### at

The at program is another means on POSIX-based systems, including macOS and Linux, to schedule a program or script job for execution at a later date and/or time, which could also be used for the same purposes.

### launchd

Each launchd job is described by a different configuration property list (plist) file similar to [Launch Daemon](https://attack.mitre.org/techniques/T1160) or [Launch Agent](https://attack.mitre.org/techniques/T1159), except there is an additional key called StartCalendarInterval with a dictionary of time values.

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ### at

The at program is another means on POSIX-based systems, including macOS and Linux, to schedule a program or script job for execution at a later date and/or time, which could also be used for the same purposes.

### launchd

Each launchd job is described by a different configuration property list (plist) file similar to [Launch Daemon](https://attack.mitre.org/techniques/T1160) or [Launch Agent](https://attack.mitre.org/techniques/T1159), except there is an additional key called StartCalendarInterval with a dictionary of time values. ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppleDocs Scheduling Timed Jobs)

Output: T1168


Instruction: List the MITRE techniques contained in the text.

Input: This only works on macOS and OS X.

Output: T1168

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This only works on macOS and OS X. ### Response: T1168.


Instruction: List the MITRE techniques contained in the text.

Input: When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively  (Citation: setuid man page).

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively  (Citation: setuid man page). ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: Normally an application is run in the current user’s context, regardless of which user or group owns the application.

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Normally an application is run in the current user’s context, regardless of which user or group owns the application. ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges.

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications.

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l.

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: The chmod program can set these bits with via bitmasking, chmod 4777

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The chmod program can set these bits with via bitmasking, chmod 4777 ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: [file] or via shorthand naming, chmod u+s

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [file] or via shorthand naming, chmod u+s ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: [file]</code>.

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [file]</code>. ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setsuid or setgid bits to get code running in a different user’s context.

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setsuid or setgid bits to get code running in a different user’s context. ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future  (Citation: OSX Keydnap malware).

Output: T1166

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future  (Citation: OSX Keydnap malware). ### Response: T1166.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: These scripts can vary based on operating system and whether applied locally or remotely.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These scripts can vary based on operating system and whether applied locally or remotely. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use these scripts to maintain persistence on a single system.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use these scripts to maintain persistence on a single system. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use startup items automatically executed at boot initialization to establish persistence.

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use startup items automatically executed at boot initialization to establish persistence. ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items)

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra.

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory. ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence)

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.

Output: T1037.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user. ### Response: T1037.005.


Instruction: List the MITRE techniques contained in the text.

Input: A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network.

Output: T1100

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. ### Response: T1100.


Instruction: List the MITRE techniques contained in the text.

Input: A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Output: T1100

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. ### Response: T1100.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client).

Output: T1100

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). ### Response: T1100.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Lee 2013)

Web shells may serve as [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a persistence mechanism in case an adversary's primary access methods are detected and removed.

Output: T1100

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Lee 2013)

Web shells may serve as [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a persistence mechanism in case an adversary's primary access methods are detected and removed. ### Response: T1100.


Instruction: List the MITRE techniques contained in the text.

Input: Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Where to use TxF)

Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Where to use TxF)

Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: BlackHat Process Doppelgänging Dec 2017)

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: BlackHat Process Doppelgänging Dec 2017) ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055) called Process Doppelgänging.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055) called Process Doppelgänging. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), Process Doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), Process Doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: Process Doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process Doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: BlackHat Process Doppelgänging Dec 2017)

Output: T1186


Instruction: List the MITRE techniques contained in the text.

Input:
Process Doppelgänging is implemented in 4 steps (Citation: BlackHat Process Doppelgänging Dec 2017):

* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process Doppelgänging is implemented in 4 steps (Citation: BlackHat Process Doppelgänging Dec 2017):

* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: These changes will be isolated and only visible within the context of the transaction.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These changes will be isolated and only visible within the context of the transaction. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: * Load – Create a shared section of memory and load the malicious executable.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Load – Create a shared section of memory and load the malicious executable. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: Rollback – Undo changes to original executable, effectively removing malicious code from the file system.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rollback – Undo changes to original executable, effectively removing malicious code from the file system. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: * Animate – Create a process from the tainted section of memory and initiate execution.

Output: T1186

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Animate – Create a process from the tainted section of memory and initiate execution. ### Response: T1186.


Instruction: List the MITRE techniques contained in the text.

Input: Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems.

Output: T1184

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. ### Response: T1184.


Instruction: List the MITRE techniques contained in the text.

Input: It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.

Output: T1184

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair. ### Response: T1184.


Instruction: List the MITRE techniques contained in the text.

Input: In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system.

Output: T1184

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. ### Response: T1184.


Instruction: List the MITRE techniques contained in the text.

Input: This may occur through compromising the SSH agent itself or by having access to the agent's socket.

Output: T1184

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may occur through compromising the SSH agent itself or by having access to the agent's socket. ### Response: T1184.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.

Output: T1184

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial. ### Response: T1184.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Slideshare Abusing SSH) (Citation: SSHjack Blackhat) (Citation: Clockwork SSH Agent Hijacking) Compromising the SSH agent also provides access to intercept SSH credentials.

Output: T1184

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Slideshare Abusing SSH) (Citation: SSHjack Blackhat) (Citation: Clockwork SSH Agent Hijacking) Compromising the SSH agent also provides access to intercept SSH credentials. ### Response: T1184.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Welivesecurity Ebury SSH)

Output: T1184

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Welivesecurity Ebury SSH) ### Response: T1184.


Instruction: List the MITRE techniques contained in the text.

Input: [SSH Hijacking](https://attack.mitre.org/techniques/T1184) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it injects into an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1184

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [SSH Hijacking](https://attack.mitre.org/techniques/T1184) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it injects into an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1184.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information in an attempt to calculate the geographical location of a victim host.

Output: T1614

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. ### Response: T1614.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Output: T1614

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. ### Response: T1614.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation:

Output: T1614

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: ### Response: T1614.


Instruction: List the MITRE techniques contained in the text.

Input: Bleepingcomputer RAT malware 2020)

Output: T1614

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Bleepingcomputer RAT malware 2020) ### Response: T1614.


Instruction: List the MITRE techniques contained in the text.

Input: Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020)

Output: T1614

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) ### Response: T1614.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation:

Output: T1614

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: ### Response: T1614.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Azure Instance Metadata 2021)

Output: T1614

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Azure Instance Metadata 2021) ### Response: T1614.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)

Output: T1614

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016) ### Response: T1614.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions.

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check)

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check) ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts.

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019)

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.(Citation:

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.(Citation: ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation:

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: SecureList SynAck Doppelgänging May 2018)

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SecureList SynAck Doppelgänging May 2018) ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.

Output: T1614.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable. ### Response: T1614.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network.

Output: T1095

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. ### Response: T1095.


Instruction: List the MITRE techniques contained in the text.

Input: The list of possible protocols is extensive.(Citation: Wikipedia OSI)

Output: T1095

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The list of possible protocols is extensive.(Citation: Wikipedia OSI) ### Response: T1095.


Instruction: List the MITRE techniques contained in the text.

Input: Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

Output: T1095

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL). ### Response: T1095.


Instruction: List the MITRE techniques contained in the text.

Input: ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP)

Output: T1095

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) ### Response: T1095.


Instruction: List the MITRE techniques contained in the text.

Input: However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.

Output: T1095

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications. ### Response: T1095.


Instruction: List the MITRE techniques contained in the text.

Input: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password.

Output: T1075

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. ### Response: T1075.


Instruction: List the MITRE techniques contained in the text.

Input: This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

Output: T1075

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. ### Response: T1075.


Instruction: List the MITRE techniques contained in the text.

Input: In this technique, valid password hashes for the account being used are captured using a Credential Access technique.

Output: T1075

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this technique, valid password hashes for the account being used are captured using a Credential Access technique. ### Response: T1075.


Instruction: List the MITRE techniques contained in the text.

Input: Captured hashes are used with PtH to authenticate as that user.

Output: T1075

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Captured hashes are used with PtH to authenticate as that user. ### Response: T1075.


Instruction: List the MITRE techniques contained in the text.

Input: Once authenticated, PtH may be used to perform actions on local or remote systems.

Output: T1075

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once authenticated, PtH may be used to perform actions on local or remote systems. ### Response: T1075.


Instruction: List the MITRE techniques contained in the text.

Input: Windows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes.

Output: T1075

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes. ### Response: T1075.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: NSA Spotting)

Output: T1075

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: NSA Spotting) ### Response: T1075.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: This is common behavior that can be used across different platforms and the network to evade defenses.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is common behavior that can be used across different platforms and the network to evade defenses. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may be compressed, archived, or encrypted in order to avoid detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may be compressed, archived, or encrypted in order to avoid detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: These payloads may be used during Initial Access or later to mitigate detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These payloads may be used during Initial Access or later to mitigate detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Volexity PowerDuke November 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Volexity PowerDuke November 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use compressed or archived scripts, such as JavaScript.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use compressed or archived scripts, such as JavaScript. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. ### Response: T1027.