Instruction: List the MITRE techniques contained in the text.

Input:
Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
*

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
* ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP)

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP) ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018) ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input: Service principal names (SPNs) are used to uniquely identify each instance of a Windows service.

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service (Citation: Microsoft Detecting Kerberoasting Feb 2018)).

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service (Citation: Microsoft Detecting Kerberoasting Feb 2018)). ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft SPN) (Citation: Microsoft SetSPN) (Citation: SANS Attacking Kerberos Nov 2014) (Citation: Harmj0y Kerberoast Nov 2016)

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft SPN) (Citation: Microsoft SetSPN) (Citation: SANS Attacking Kerberos Nov 2014) (Citation: Harmj0y Kerberoast Nov 2016) ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC). ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Empire InvokeKerberoast Oct 2016) (Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Empire InvokeKerberoast Oct 2016) (Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials.

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials. ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AdSecurity Cracking Kerberos Dec 2015)

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AdSecurity Cracking Kerberos Dec 2015) ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016)

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016) ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: This same attack could be executed using service tickets captured from network traffic.

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This same attack could be executed using service tickets captured from network traffic. ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AdSecurity Cracking Kerberos Dec 2015)

Output: T1208


Instruction: List the MITRE techniques contained in the text.

Input: Cracked hashes may enable Persistence, Privilege Escalation, and  Lateral Movement via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cracked hashes may enable Persistence, Privilege Escalation, and  Lateral Movement via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: SANS Attacking Kerberos Nov 2014)

Output: T1208

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SANS Attacking Kerberos Nov 2014) ### Response: T1208.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed.

Output: T1027.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. ### Response: T1027.005.


Instruction: List the MITRE techniques contained in the text.

Input: They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.

Output: T1027.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. ### Response: T1027.005.


Instruction: List the MITRE techniques contained in the text.

Input: A good example of this is when malware is detected with a file signature and quarantined by anti-virus software.

Output: T1027.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. ### Response: T1027.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.

Output: T1027.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware. ### Response: T1027.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may embed payloads within other files to conceal malicious content from defenses.

Output: T1027.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may embed payloads within other files to conceal malicious content from defenses. ### Response: T1027.009.


Instruction: List the MITRE techniques contained in the text.

Input: Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content.

Output: T1027.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. ### Response: T1027.009.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs)

Output: T1027.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs) ### Response: T1027.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn)

Output: T1027.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn) ### Response: T1027.009.


Instruction: List the MITRE techniques contained in the text.

Input: This is similar to [Steganography](https://attack.mitre.org/techniques/T1027/003), though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage)

Output: T1027.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is similar to [Steganography](https://attack.mitre.org/techniques/T1027/003), though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage) ### Response: T1027.009.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2)

Output: T1027.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2) ### Response: T1027.009.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021)

Embedded content may also be used as [Process Injection](https://attack.mitre.org/techniques/T1055) payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module.

Output: T1027.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021)

Embedded content may also be used as [Process Injection](https://attack.mitre.org/techniques/T1055) payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. ### Response: T1027.009.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT)

Output: T1027.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT) ### Response: T1027.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse this LNK metadata to download malicious payloads.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse this LNK metadata to download malicious payloads. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries have been observed using LNK files as phishing payloads to deliver malware.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries have been observed using LNK files as phishing payloads to deliver malware. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: Once invoked (e.g., [Malicious File](https://attack.mitre.org/techniques/T1204/002)), payloads referenced via external URLs within the LNK icon location field may be downloaded.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once invoked (e.g., [Malicious File](https://attack.mitre.org/techniques/T1204/002)), payloads referenced via external URLs within the LNK icon location field may be downloaded. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: These files may also then be invoked by [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)/[System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218) arguments within the target path field of the LNK.(Citation:

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These files may also then be invoked by [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)/[System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218) arguments within the target path field of the LNK.(Citation: ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input:
Unprotect Shortcut)(Citation: Booby Trap Shortcut 2017)

LNK Icon Smuggling may also be utilized post compromise, such as malicious scripts executing an LNK on an infected host to download additional malicious payloads.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unprotect Shortcut)(Citation: Booby Trap Shortcut 2017)

LNK Icon Smuggling may also be utilized post compromise, such as malicious scripts executing an LNK on an infected host to download additional malicious payloads. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files.

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects.

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents.

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation:

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: HTML Smuggling Menlo Security 2020)(Citation:

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HTML Smuggling Menlo Security 2020)(Citation: ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: Outlflank HTML Smuggling 2018)

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlflank HTML Smuggling 2018) ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes.

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html.

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html. ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)), potentially bypassing content filters.

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)), potentially bypassing content filters. ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.(Citation:

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.(Citation: ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: HTML Smuggling Menlo Security 2020)(Citation:

Output: T1027.006


Instruction: List the MITRE techniques contained in the text.

Input: MSTIC NOBELIUM May 2021)(Citation:

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MSTIC NOBELIUM May 2021)(Citation: ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: Outlflank HTML Smuggling 2018)(Citation:

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlflank HTML Smuggling 2018)(Citation: ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: nccgroup Smuggling HTA 2017)

Output: T1027.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: nccgroup Smuggling HTA 2017) ### Response: T1027.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses.

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Fileless storage can be broadly defined as any format other than a file.

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Fileless storage can be broadly defined as any format other than a file. ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation:

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft Fileless)(Citation: SecureList Fileless)

Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620)

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Fileless)(Citation: SecureList Fileless)

Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: and [Process Injection](https://attack.mitre.org/techniques/T1055)

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: and [Process Injection](https://attack.mitre.org/techniques/T1055) ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: , fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage.

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: , fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage. ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)).

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored.

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored. ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless)

Output: T1027.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless) ### Response: T1027.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obfuscate content during command execution to impede detection.

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obfuscate content during command execution to impede detection. ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze.

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE) ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing,  `^`, `+`.

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing,  `^`, `+`. ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell)

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64)

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017) ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\.. ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: \Windows\tei\qs\k\..\..

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: \Windows\tei\qs\k\..\.. ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input:
\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)

Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)

Output: T1027.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: \..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)

Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation) ### Response: T1027.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code.

Output: T1027.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. ### Response: T1027.004.


Instruction: List the MITRE techniques contained in the text.

Input: Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries.

Output: T1027.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. ### Response: T1027.004.


Instruction: List the MITRE techniques contained in the text.

Input:
These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)

Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566).

Output: T1027.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)

Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). ### Response: T1027.004.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)

Output: T1027.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac) ### Response: T1027.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: API functions called by malware may leave static artifacts such as strings in payload files.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: API functions called by malware may leave static artifacts such as strings in payload files. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input:
Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing)

To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing)

To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Various methods may be used to obfuscate malware calls to API functions.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various methods may be used to obfuscate malware calls to API functions. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: For example, hashes of function names are commonly stored in malware in lieu of literal strings.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, hashes of function names are commonly stored in malware in lieu of literal strings. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation:

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation: ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash)

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash) ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use steganography techniques in order to prevent the detection of hidden information.

Output: T1027.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use steganography techniques in order to prevent the detection of hidden information. ### Response: T1027.003.


Instruction: List the MITRE techniques contained in the text.

Input: Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.

Output: T1027.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. ### Response: T1027.003.


Instruction: List the MITRE techniques contained in the text.

Input: [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography.

Output: T1027.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. ### Response: T1027.003.


Instruction: List the MITRE techniques contained in the text.

Input: It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu)

Output: T1027.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) ### Response: T1027.003.


Instruction: List the MITRE techniques contained in the text.

Input: By the end of 2017, a threat group used Invoke-PSImage to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system.

Output: T1027.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By the end of 2017, a threat group used Invoke-PSImage to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. ### Response: T1027.003.


Instruction: List the MITRE techniques contained in the text.

Input: In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation:

Output: T1027.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: ### Response: T1027.003.


Instruction: List the MITRE techniques contained in the text.

Input: McAfee Malicious Doc Targets Pyeongchang Olympics)

Output: T1027.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: McAfee Malicious Doc Targets Pyeongchang Olympics) ### Response: T1027.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Scripts and executables may contain variables names and other strings that help developers document code functionality.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripts and executables may contain variables names and other strings that help developers document code functionality. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Symbols are often created by an operating system’s `linker` when executable payloads are compiled.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Symbols are often created by an operating system’s `linker` when executable payloads are compiled. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018)

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use stripped payloads in order to make malware analysis more difficult.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use stripped payloads in order to make malware analysis more difficult. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, compilers and other tools may provide features to remove or obfuscate strings and symbols.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis.

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)

Output: T1027.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021) ### Response: T1027.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform software packing or virtual machine software protection to conceal their code.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform software packing or virtual machine software protection to conceal their code. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Software packing is a method of compressing or encrypting an executable.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Software packing is a method of compressing or encrypting an executable. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Packing an executable changes the file signature in an attempt to avoid signature-based detection.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Packing an executable changes the file signature in an attempt to avoid signature-based detection. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Most decompression techniques decompress the executable code in memory.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most decompression techniques decompress the executable code in memory. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities used to perform software packing are called packers.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities used to perform software packing are called packers. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Example packers are MPRESS and UPX.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example packers are MPRESS and UPX. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation:

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Awesome Executable Packing)

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Awesome Executable Packing) ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use binary padding to add junk data and change the on-disk representation of malware.

Output: T1027.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. ### Response: T1027.001.


Instruction: List the MITRE techniques contained in the text.

Input: This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.

Output: T1027.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. ### Response: T1027.001.


Instruction: List the MITRE techniques contained in the text.

Input: Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus)

Output: T1027.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) ### Response: T1027.001.


Instruction: List the MITRE techniques contained in the text.

Input: The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation:

Output: T1027.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: ### Response: T1027.001.


Instruction: List the MITRE techniques contained in the text.

Input: Securelist Malware Tricks April 2017)

Output: T1027.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Securelist Malware Tricks April 2017) ### Response: T1027.001.


Instruction: List the MITRE techniques contained in the text.

Input: Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files.

Output: T1027.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. ### Response: T1027.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may also reduce the likelihood of being collected for analysis.

Output: T1027.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also reduce the likelihood of being collected for analysis. ### Response: T1027.001.


Instruction: List the MITRE techniques contained in the text.

Input: Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)

Output: T1027.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ) ### Response: T1027.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: This is common behavior that can be used across different platforms and the network to evade defenses.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is common behavior that can be used across different platforms and the network to evade defenses. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may be compressed, archived, or encrypted in order to avoid detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may be compressed, archived, or encrypted in order to avoid detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: These payloads may be used during Initial Access or later to mitigate detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These payloads may be used during Initial Access or later to mitigate detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Volexity PowerDuke November 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Volexity PowerDuke November 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use compressed or archived scripts, such as JavaScript.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use compressed or archived scripts, such as JavaScript. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Linux/Cdorked.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Linux/Cdorked. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: A We Live Security Analysis)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A We Live Security Analysis) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Obfuscation Sept 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Obfuscation Sept 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Obfuscation June 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Obfuscation June 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Output: T1556.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. ### Response: T1556.006.


Instruction: List the MITRE techniques contained in the text.

Input: Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their access to modify or completely disable MFA defenses.

Output: T1556.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their access to modify or completely disable MFA defenses. ### Response: T1556.006.


Instruction: List the MITRE techniques contained in the text.

Input: This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.(Citation: Mandiant APT42)(Citation: Azure AD Conditional Access Exclusions)

Output: T1556.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.(Citation: Mandiant APT42)(Citation: Azure AD Conditional Access Exclusions) ### Response: T1556.006.


Instruction: List the MITRE techniques contained in the text.

Input: For example, modifying the Windows hosts file (`C:\windows\system32\drivers\etc\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail.

Output: T1556.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, modifying the Windows hosts file (`C:\windows\system32\drivers\etc\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. ### Response: T1556.006.


Instruction: List the MITRE techniques contained in the text.

Input: If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA.

Output: T1556.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA. ### Response: T1556.006.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Russians Exploit Default MFA Protocol - CISA March 2022)

Output: T1556.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Russians Exploit Default MFA Protocol - CISA March 2022) ### Response: T1556.006.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022)

Output: T1556.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022) ### Response: T1556.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target user email to collect sensitive information.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target user email to collect sensitive information. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can collect or forward email from mail servers or clients.

Output: T1114

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can collect or forward email from mail servers or clients. ### Response: T1114.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.

Output: T1114.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. ### Response: T1114.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network.

Output: T1114.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. ### Response: T1114.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens.

Output: T1114.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. ### Response: T1114.002.


Instruction: List the MITRE techniques contained in the text.

Input: Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.

Output: T1114.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords. ### Response: T1114.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application.

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW) ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence.

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: IIS provides several mechanisms to extend the functionality of the web servers.

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IIS provides several mechanisms to extend the functionality of the web servers. ### Response: T1505.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests.

Output: T1505.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. ### Response: T1505.004.