Instruction: List the MITRE techniques contained in the text.

Input: When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation:

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye POSHSPY April 2017)(Citation:

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye POSHSPY April 2017)(Citation: ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: ESET Sednit 2017 Activity)

Output: T1568

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ESET Sednit 2017 Activity) ### Response: T1568.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution.

Output: T1568.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. ### Response: T1568.001.


Instruction: List the MITRE techniques contained in the text.

Input: This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity)

Output: T1568.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity) ### Response: T1568.001.


Instruction: List the MITRE techniques contained in the text.

Input: The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name.

Output: T1568.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name. ### Response: T1568.001.


Instruction: List the MITRE techniques contained in the text.

Input: These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity)

Output: T1568.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity) ### Response: T1568.001.


Instruction: List the MITRE techniques contained in the text.

Input: In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection.

Output: T1568.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. ### Response: T1568.001.


Instruction: List the MITRE techniques contained in the text.

Input: With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.

Output: T1568.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel. ### Response: T1568.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various means to detect and avoid virtualization and analysis environments. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: They may also search for VME artifacts before dropping secondary or additional payloads.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also search for VME artifacts before dropping secondary or additional payloads. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015) ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: They may also search for VME artifacts before dropping secondary or additional payloads.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also search for VME artifacts before dropping secondary or additional payloads. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001),

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: [System Information Discovery](https://attack.mitre.org/techniques/T1082), and

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [System Information Discovery](https://attack.mitre.org/techniques/T1082), and ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use scripting to automate these checks  into one script and then have the program exit if it determines the system to be a virtual environment.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use scripting to automate these checks  into one script and then have the program exit if it determines the system to be a virtual environment. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Checks could include generic system properties such as host/domain name and samples of network traffic.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Checks could include generic system properties such as host/domain name and samples of network traffic. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017)

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment.

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)

Output: T1497.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018) ### Response: T1497.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation:

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Task Scheduler Security)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet Task Scheduler Security) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques)

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: The cron utility is a time-based job scheduler for Unix-like operating systems.

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The cron utility is a time-based job scheduler for Unix-like operating systems. ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: The <code>

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The <code> ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: crontab</code> file contains the schedule of cron entries to be run and the specified times for execution.

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: Any crontab files are stored in operating system-specific file paths.

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Any crontab files are stored in operating system-specific file paths. ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003).

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to discover group and permission settings.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to discover group and permission settings. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to discover group permission settings in many different ways.

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to discover group permission settings in many different ways. ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)

Output: T1069

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018) ### Response: T1069.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to find domain-level groups and permission settings.

Output: T1069.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to find domain-level groups and permission settings. ### Response: T1069.002.


Instruction: List the MITRE techniques contained in the text.

Input: The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.

Output: T1069.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. ### Response: T1069.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Commands such as net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility,  dscacheutil -q

Output: T1069.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Commands such as net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility,  dscacheutil -q ### Response: T1069.002.


Instruction: List the MITRE techniques contained in the text.

Input: group on macOS, and ldapsearch on Linux can list domain-level groups.

Output: T1069.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: group on macOS, and ldapsearch on Linux can list domain-level groups. ### Response: T1069.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal capabilities that can be used during targeting.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal capabilities that can be used during targeting. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries).

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire information about vulnerabilities that can be used during targeting.

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire information about vulnerabilities that can be used during targeting. ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur.

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database)

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database) ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities.

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: There is usually a delay between when a vulnerability is discovered and when it is made public.

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There is usually a delay between when a vulnerability is discovered and when it is made public. ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors).

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)). ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send phishing messages to gain access to victim systems.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send phishing messages to gain access to victim systems. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing can be targeted, known as spearphishing.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing can be targeted, known as spearphishing. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing may also be conducted via third-party services, like social media platforms.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing may also be conducted via third-party services, like social media platforms. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Palo Alto Unit 42 VBA Infostealer 2014)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Palo Alto Unit 42 VBA Infostealer 2014) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Unit42 Luna Moth)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit42 Luna Moth) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing with a link is a specific variant of spearphishing.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing with a link is a specific variant of spearphishing. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: In this case, the malicious emails contain links.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this case, the malicious emails contain links. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023)

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to  [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation:

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to  [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Trend Micro Pawn Storm OAuth 2017)

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trend Micro Pawn Storm OAuth 2017) ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft OAuth 2.0

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft OAuth 2.0 ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Consent Phishing 2021)

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Consent Phishing 2021) ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items).

Output: T1165

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items). ### Response: T1165.


Instruction: List the MITRE techniques contained in the text.

Input: This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra.

Output: T1165

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. ### Response: T1165.


Instruction: List the MITRE techniques contained in the text.

Input: A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.

Output: T1165

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory. ### Response: T1165.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism (Citation: Methods of Mac Malware Persistence).

Output: T1165

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism (Citation: Methods of Mac Malware Persistence). ### Response: T1165.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, since StartupItems run during the bootup phase of macOS, they will run as root.

Output: T1165

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, since StartupItems run during the bootup phase of macOS, they will run as root. ### Response: T1165.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to modify an existing Startup Item, then they will be able to Privilege Escalate as well.

Output: T1165

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to modify an existing Startup Item, then they will be able to Privilege Escalate as well. ### Response: T1165.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This may compromise the integrity of security solutions by causing notable events to go unreported.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may compromise the integrity of security solutions by causing notable events to go unreported. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear system logs to hide evidence of an intrusion.

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear system logs to hide evidence of an intrusion. ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input: macOS and Linux both keep track of system or user-initiated actions via system logs.

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: macOS and Linux both keep track of system or user-initiated actions via system logs. ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input: The majority of native system logging is stored under the <code>/var/log/</code> directory.

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The majority of native system logging is stored under the <code>/var/log/</code> directory. ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

* <code>/var/log/messages:</code>:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

* <code>/var/log/messages:</code>: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
General and system-related messages
* /var/log/secure or /var/log/auth.log:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: General and system-related messages
* /var/log/secure or /var/log/auth.log: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Authentication logs
* /var/log/utmp or /var/log/wtmp:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Authentication logs
* /var/log/utmp or /var/log/wtmp: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Login records
* <code>/var/log/kern.log</code>:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login records
* <code>/var/log/kern.log</code>: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Kernel logs
*

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kernel logs
* ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input: <code>/var/log/cron.log</code>:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: <code>/var/log/cron.log</code>: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Crond logs
* /var/log/maillog: Mail server logs
* /var/log/httpd/: Web server access and error logs

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Crond logs
* /var/log/maillog: Mail server logs
* /var/log/httpd/: Web server access and error logs ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Example services include websites, email services, DNS, and web-based applications.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example services include websites, email services, DNS, and web-based applications. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can target various layers of the application stack that is hosted on the system used to provide the service.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Botnets are commonly used to conduct DDoS attacks against networks and services.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Botnets are commonly used to conduct DDoS attacks against networks and services. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Large botnets can generate a significant amount of traffic from systems spread across the global internet.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Large botnets can generate a significant amount of traffic from systems spread across the global internet. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016) ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China) ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: For attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498). ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Output: T1499.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. ### Response: T1499.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Sucuri BIND9 August 2015)

Output: T1499.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Sucuri BIND9 August 2015) ### Response: T1499.004.


Instruction: List the MITRE techniques contained in the text.

Input: Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Output: T1499.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. ### Response: T1499.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition.

Output: T1499.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. ### Response: T1499.004.


Instruction: List the MITRE techniques contained in the text.

Input: Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485),

Output: T1499.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), ### Response: T1499.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.

Output: T1499.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems. ### Response: T1499.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

Output: T1137.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. ### Response: T1137.002.


Instruction: List the MITRE techniques contained in the text.

Input: An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started.

Output: T1137.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. ### Response: T1137.002.


Instruction: List the MITRE techniques contained in the text.

Input: This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications.

Output: T1137.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. ### Response: T1137.002.


Instruction: List the MITRE techniques contained in the text.

Input: This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)

Output: T1137.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy) ### Response: T1137.002.


Instruction: List the MITRE techniques contained in the text.

Input: There exist user and global Registry keys for the Office Test feature:

Output: T1137.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There exist user and global Registry keys for the Office Test feature: ### Response: T1137.002.


Instruction: List the MITRE techniques contained in the text.

Input:
* HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf
* HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf

Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.

Output: T1137.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf
* HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf

Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started. ### Response: T1137.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Office contains templates that are part of common Office applications and are used to customize styles.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Office contains templates that are part of common Office applications and are used to customize styles. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: The base templates within the application are used each time an application starts.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The base templates within the application are used each time an application starts. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Change Normal Template)

Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Change Normal Template)

Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Examples for both Word and Excel have been discovered and published.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples for both Word and Excel have been discovered and published. ### Response: T1137.001.