Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing attachment is a specific variant of spearphishing.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing attachment is a specific variant of spearphishing. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Registry stores configuration information that can be used by the system or other programs.

Output: T1214

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Registry stores configuration information that can be used by the system or other programs. ### Response: T1214.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services.

Output: T1214

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. ### Response: T1214.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes these credentials are used for automatic logons.

Output: T1214

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes these credentials are used for automatic logons. ### Response: T1214.


Instruction: List the MITRE techniques contained in the text.

Input:
Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

* Local Machine Hive: <code>reg query HKLM /f password /t

Output: T1214

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

* Local Machine Hive: <code>reg query HKLM /f password /t ### Response: T1214.


Instruction: List the MITRE techniques contained in the text.

Input:
REG_SZ /s</code>
*

Output: T1214

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: REG_SZ /s</code>
* ### Response: T1214.


Instruction: List the MITRE techniques contained in the text.

Input: Current User Hive: <code>reg query HKCU /f

Output: T1214

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Current User Hive: <code>reg query HKCU /f ### Response: T1214.


Instruction: List the MITRE techniques contained in the text.

Input: password /t

Output: T1214

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: password /t ### Response: T1214.


Instruction: List the MITRE techniques contained in the text.

Input: REG_SZ /s</code>

Output: T1214

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: REG_SZ /s</code> ### Response: T1214.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: This is common behavior that can be used across different platforms and the network to evade defenses.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is common behavior that can be used across different platforms and the network to evade defenses. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may be compressed, archived, or encrypted in order to avoid detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may be compressed, archived, or encrypted in order to avoid detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: These payloads may be used during Initial Access or later to mitigate detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These payloads may be used during Initial Access or later to mitigate detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Volexity PowerDuke November 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Volexity PowerDuke November 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use compressed or archived scripts, such as JavaScript.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use compressed or archived scripts, such as JavaScript. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Linux/Cdorked.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Linux/Cdorked. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: A We Live Security Analysis)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A We Live Security Analysis) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Obfuscation Sept 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Obfuscation Sept 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Obfuscation June 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Obfuscation June 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Scripts and executables may contain variables names and other strings that help developers document code functionality.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripts and executables may contain variables names and other strings that help developers document code functionality. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Symbols are often created by an operating system’s `linker` when executable payloads are compiled.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Symbols are often created by an operating system’s `linker` when executable payloads are compiled. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018)

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use stripped payloads in order to make malware analysis more difficult.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use stripped payloads in order to make malware analysis more difficult. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, compilers and other tools may provide features to remove or obfuscate strings and symbols.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021) ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC is typically used by processes to share data, communicate with each other, or synchronize execution.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC is typically used by processes to share data, communicate with each other, or synchronize execution. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse IPC to execute arbitrary code or commands.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse IPC to execute arbitrary code or commands. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001).

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001). ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019) ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the Windows Component Object Model (COM) for local code execution.

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the Windows Component Object Model (COM) for local code execution. ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019)

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM)

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as  [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)

Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation:

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as  [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)

Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: Fireeye Hunting COM June 2019)(Citation:

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Fireeye Hunting COM June 2019)(Citation: ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: ProjectZero File Write EoP Apr 2018)

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ProjectZero File Write EoP Apr 2018) ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: How the operating system locates libraries to be used by a program can also be intercepted.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: How the operating system locates libraries to be used by a program can also be intercepted. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Windows systems use a common method to look for required DLLs to load into a program.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows systems use a common method to look for required DLLs to load into a program. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010)

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary can hijack DLL loads.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary can hijack DLL loads. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011)

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Security Advisory 2269637)

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Security Advisory 2269637) ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation:

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking) ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.

Output: T1574.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace. ### Response: T1574.001.


Instruction: List the MITRE techniques contained in the text.

Input: Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Output: T1119

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once established within a system or network, an adversary may use automated techniques for collecting internal data. ### Response: T1119.


Instruction: List the MITRE techniques contained in the text.

Input: Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

Output: T1119

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. ### Response: T1119.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud-based environments, adversaries may also use cloud APIs, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.

Output: T1119

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud-based environments, adversaries may also use cloud APIs, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. ### Response: T1119.


Instruction: List the MITRE techniques contained in the text.

Input: This functionality could also be built into remote access tools.

Output: T1119

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This functionality could also be built into remote access tools. ### Response: T1119.


Instruction: List the MITRE techniques contained in the text.

Input: This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and

Output: T1119

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and ### Response: T1119.


Instruction: List the MITRE techniques contained in the text.

Input: [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments.

Output: T1119

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments. ### Response: T1119.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Output: T1115

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may collect data stored in the clipboard from users copying information within or between applications. ### Response: T1115.


Instruction: List the MITRE techniques contained in the text.

Input: For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B)

Output: T1115

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) ### Response: T1115.


Instruction: List the MITRE techniques contained in the text.

Input:
Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs)

macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre)

Output: T1115

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs)

macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre) ### Response: T1115.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Additional custom tools likely exist as well.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional custom tools likely exist as well. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather credentials from the proc filesystem or `/proc`.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather credentials from the proc filesystem or `/proc`. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation:

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: baeldung Linux proc map 2022)

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: baeldung Linux proc map 2022) ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns that are indicative of credentials, such as looking for fixed strings in memory structures or cached hashes.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns that are indicative of credentials, such as looking for fixed strings in memory structures or cached hashes. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: When running without privileged access, processes can still view their own virtual memory locations.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When running without privileged access, processes can still view their own virtual memory locations. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: Some services or programs may save credentials in clear text inside the process’s memory.(Citation: MimiPenguin GitHub May 2017)(Citation:

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some services or programs may save credentials in clear text inside the process’s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: Polop Linux PrivEsc Gitbook)

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Polop Linux PrivEsc Gitbook) ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation:

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT29 Microsoft 365 2022)

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT29 Microsoft 365 2022) ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting.

Output: T1583.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. ### Response: T1583.005.


Instruction: List the MITRE techniques contained in the text.

Input: A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet)

Output: T1583.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) ### Response: T1583.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service.

Output: T1583.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service. ### Response: T1583.005.


Instruction: List the MITRE techniques contained in the text.

Input: With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter)

Output: T1583.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter) ### Response: T1583.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for common password storage locations to obtain user credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for common password storage locations to obtain user credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Password managers are applications designed to store user credentials, normally in an encrypted database.

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Password managers are applications designed to store user credentials, normally in an encrypted database. ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials are typically accessible after a user provides a master password that unlocks the database.

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials are typically accessible after a user provides a master password that unlocks the database. ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: After the database is unlocked, these credentials may be copied to memory.

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the database is unlocked, these credentials may be copied to memory. ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These databases can be stored as files on disk.(Citation: ise Password Manager February 2019) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation:

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: NVD CVE-2019-3610)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NVD CVE-2019-3610) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll.

Output: T1103

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. ### Response: T1103.


Instruction: List the MITRE techniques contained in the text.

Input: In practice this is nearly every program, since user32.dll is a very common library.

Output: T1103

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In practice this is nearly every program, since user32.dll is a very common library. ### Response: T1103.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Elastic Process Injection July 2017)

Output: T1103

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017) ### Response: T1103.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Output: T1103

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. ### Response: T1103.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppInit Registry)

Output: T1103

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AppInit Registry) ### Response: T1103.


Instruction: List the MITRE techniques contained in the text.

Input: The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.

Output: T1103

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. ### Response: T1103.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppInit Secure Boot)

Output: T1103

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AppInit Secure Boot) ### Response: T1103.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to subvert these trust mechanisms.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to subvert these trust mechanisms. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: The method adversaries use will depend on the specific mechanism they seek to subvert.

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The method adversaries use will depend on the specific mechanism they seek to subvert. ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017)

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates)

Output: T1553

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates) ### Response: T1553.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Gatekeeper also treats applications running for the first time differently than reopened applications.(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: TheEclecticLightCompany apple notarization )

Based on an opt-in system, when files are downloaded an extended attribute (xattr) called `com.apple.quarantine` (also known as a quarantine flag) can be set on the file by the application performing the download.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gatekeeper also treats applications running for the first time differently than reopened applications.(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: TheEclecticLightCompany apple notarization )

Based on an opt-in system, when files are downloaded an extended attribute (xattr) called `com.apple.quarantine` (also known as a quarantine flag) can be set on the file by the application performing the download. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Services opens the application in a suspended state.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Services opens the application in a suspended state. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input:
For first run applications with the quarantine flag set, Gatekeeper executes the following functions:

1.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For first run applications with the quarantine flag set, Gatekeeper executes the following functions:

1. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Checks extended attribute – Gatekeeper checks for the quarantine flag, then provides an alert prompt to the user to allow or deny execution.(Citation: OceanLotus for OS X)(Citation: 20 macOS Common Tools and Techniques)

2. Checks System Policies - Gatekeeper checks the system security policy, allowing execution of apps downloaded from either just the App Store or the App Store and identified developers.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Checks extended attribute – Gatekeeper checks for the quarantine flag, then provides an alert prompt to the user to allow or deny execution.(Citation: OceanLotus for OS X)(Citation: 20 macOS Common Tools and Techniques)

2. Checks System Policies - Gatekeeper checks the system security policy, allowing execution of apps downloaded from either just the App Store or the App Store and identified developers. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: 3. Code Signing – Gatekeeper checks for a valid code signature from an Apple Developer ID.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 3. Code Signing – Gatekeeper checks for a valid code signature from an Apple Developer ID. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: 4. Notarization - Using the `api.apple-cloudkit.com` API, Gatekeeper reaches out to Apple servers to verify or pull down the notarization ticket and ensure the ticket is not revoked.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 4. Notarization - Using the `api.apple-cloudkit.com` API, Gatekeeper reaches out to Apple servers to verify or pull down the notarization ticket and ensure the ticket is not revoked. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: Users can override notarization, which will result in a prompt of executing an “unauthorized app” and the security policy will be modified.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users can override notarization, which will result in a prompt of executing an “unauthorized app” and the security policy will be modified. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can subvert one or multiple security controls within Gatekeeper checks through logic errors (e.g. [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211)), unchecked file types, and external libraries.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can subvert one or multiple security controls within Gatekeeper checks through logic errors (e.g. [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211)), unchecked file types, and external libraries. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, prior to macOS 13 Ventura, code signing and notarization checks were only conducted on first launch, allowing adversaries to write malicious executables to previously opened applications in order to bypass Gatekeeper security checks.(Citation: theevilbit gatekeeper bypass 2021)(Citation:

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, prior to macOS 13 Ventura, code signing and notarization checks were only conducted on first launch, allowing adversaries to write malicious executables to previously opened applications in order to bypass Gatekeeper security checks.(Citation: theevilbit gatekeeper bypass 2021)(Citation: ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Application Bundle Manipulation Brandon Dalton)

Applications and files loaded onto the system from a USB flash drive, optical disk, external hard drive, from a drive shared over the local network, or using the curl command may not set the quarantine flag.

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Application Bundle Manipulation Brandon Dalton)

Applications and files loaded onto the system from a USB flash drive, optical disk, external hard drive, from a drive shared over the local network, or using the curl command may not set the quarantine flag. ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, it is possible to avoid setting the quarantine flag using [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).

Output: T1553.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, it is possible to avoid setting the quarantine flag using [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). ### Response: T1553.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control.

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. ### Response: T1608.


Instruction: List the MITRE techniques contained in the text.

Input: These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).

Output: T1608

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). ### Response: T1608.