Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: Information about email addresses and accounts may also be extracted by searching an infected system’s files.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about email addresses and accounts may also be extracted by searching an infected system’s files. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of cloud accounts.

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of cloud accounts. ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: With authenticated access there are several tools that can be used to find accounts.

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With authenticated access there are several tools that can be used to find accounts. ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation:

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft msolrolemember)(Citation: GitHub Raindance)

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft msolrolemember)(Citation: GitHub Raindance) ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain.

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation:

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: Black Hills Red Teaming MS AD Azure, 2018)

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Black Hills Red Teaming MS AD Azure, 2018) ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API) ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get information about running processes on a system.

Output: T1057

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get information about running processes on a system. ### Response: T1057.


Instruction: List the MITRE techniques contained in the text.

Input: Information obtained could be used to gain an understanding of common software/applications running on systems within the network.

Output: T1057

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information obtained could be used to gain an understanding of common software/applications running on systems within the network. ### Response: T1057.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Output: T1057

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. ### Response: T1057.


Instruction: List the MITRE techniques contained in the text.

Input: In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001).

Output: T1057

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). ### Response: T1057.


Instruction: List the MITRE techniques contained in the text.

Input: Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot.

Output: T1057

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. ### Response: T1057.


Instruction: List the MITRE techniques contained in the text.

Input: In Mac and Linux, this is accomplished with the ps command.

Output: T1057

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Mac and Linux, this is accomplished with the ps command. ### Response: T1057.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also opt to enumerate processes via /proc.

Output: T1057

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also opt to enumerate processes via /proc. ### Response: T1057.


Instruction: List the MITRE techniques contained in the text.

Input: On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)

Output: T1057

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd) ### Response: T1057.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown) ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may impair command history logging to hide commands they run on a compromised system.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may impair command history logging to hide commands they run on a compromised system. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace".

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace". ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups".

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: This means that “ ls” will not be saved, but “ls” would be saved by history.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This means that “ ls” will not be saved, but “ls” would be saved by history. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: This will cause ConsoleHost_history.txt to stop receiving logs.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This will cause ConsoleHost_history.txt to stop receiving logs. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, it is possible to turn off logging to this file using the PowerShell command <code>Set-PSReadlineOption -HistorySaveStyle

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, it is possible to turn off logging to this file using the PowerShell command <code>Set-PSReadlineOption -HistorySaveStyle ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: SaveNothing</code>.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SaveNothing</code>.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics) ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to disable historical command logging (e.g. no logging).

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to disable historical command logging (e.g. no logging). ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation:

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Task Scheduler Security)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet Task Scheduler Security) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: This technique is deprecated due to the inaccurate usage.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique is deprecated due to the inaccurate usage. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: Other system services are used to interact with launchd rather than launchd being used by itself.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other system services are used to interact with launchd rather than launchd being used by itself. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the Launchd daemon to perform task scheduling for initial or recurring execution of malicious code.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the Launchd daemon to perform task scheduling for initial or recurring execution of malicious code. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: The launchd daemon, native to macOS, is responsible for loading and maintaining services within the operating system.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The launchd daemon, native to macOS, is responsible for loading and maintaining services within the operating system. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons).

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use the launchd daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use the launchd daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: launchd can also be abused to run a process under the context of a specified account.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: launchd can also be abused to run a process under the context of a specified account. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: Daemons, such as launchd, run with the permissions of the root user account, and will operate regardless of which user account is logged in.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Daemons, such as launchd, run with the permissions of the root user account, and will operate regardless of which user account is logged in. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process.

Output: T1556.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. ### Response: T1556.008.


Instruction: List the MITRE techniques contained in the text.

Input: Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC.

Output: T1556.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. ### Response: T1556.008.


Instruction: List the MITRE techniques contained in the text.

Input: The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify)

Output: T1556.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify) ### Response: T1556.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.(Citation: NPPSPY)

Output: T1556.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.(Citation: NPPSPY) ### Response: T1556.008.


Instruction: List the MITRE techniques contained in the text.

Input: Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.(Citation: NPLogonNotify)

Output: T1556.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.(Citation: NPLogonNotify) ### Response: T1556.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.(Citation: NPPSPY - Huntress)

Output: T1556.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.(Citation: NPPSPY - Huntress) ### Response: T1556.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft DART Case Report 001)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft DART Case Report 001) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Malware Persistence on OS X)(Citation: amnesia malware)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware Persistence on OS X)(Citation: amnesia malware) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime.(Citation: Mandiant M-Trends 2015)

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime.(Citation: Mandiant M-Trends 2015) ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015)

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation:

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft MOF May 2018)

WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.

Output: T1546.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft MOF May 2018)

WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. ### Response: T1546.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search freely available technical databases for information about victims that can be used during targeting.

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search freely available technical databases for information about victims that can be used during targeting. ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation:

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: DigitalShadows CDN)(Citation: Shodan)

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DigitalShadows CDN)(Citation: Shodan) ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search in different open databases depending on what information they seek to gather.

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search in different open databases depending on what information they seek to gather. ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1596

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1596.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting.

Output: T1596.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. ### Response: T1596.004.


Instruction: List the MITRE techniques contained in the text.

Input: CDNs allow an organization to host content from a distributed, load balanced array of servers.

Output: T1596.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CDNs allow an organization to host content from a distributed, load balanced array of servers. ### Response: T1596.004.


Instruction: List the MITRE techniques contained in the text.

Input: CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region.

Output: T1596.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. ### Response: T1596.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search CDN data to gather actionable information.

Output: T1596.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search CDN data to gather actionable information. ### Response: T1596.004.


Instruction: List the MITRE techniques contained in the text.

Input: Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN.

Output: T1596.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. ### Response: T1596.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website.(Citation: DigitalShadows CDN)

Output: T1596.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website.(Citation: DigitalShadows CDN) ### Response: T1596.004.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1596.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1596.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)).

Output: T1596.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)). ### Response: T1596.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various means to detect and avoid virtualization and analysis environments. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: They may also search for VME artifacts before dropping secondary or additional payloads.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also search for VME artifacts before dropping secondary or additional payloads. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment.

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)

Output: T1497

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015) ### Response: T1497.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: They may also search for VME artifacts before dropping secondary or additional payloads.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also search for VME artifacts before dropping secondary or additional payloads. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop.

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017)

Output: T1497.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017) ### Response: T1497.002.


Instruction: List the MITRE techniques contained in the text.

Input: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)).

Output: T1141

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)). ### Response: T1141.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper)

Output: T1141

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) ### Response: T1141.


Instruction: List the MITRE techniques contained in the text.

Input: This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1155)(Citation:

Output: T1141

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1155)(Citation: ### Response: T1141.


Instruction: List the MITRE techniques contained in the text.

Input: LogRhythm Do You Trust Oct 2014)(Citation:

Output: T1141

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: LogRhythm Do You Trust Oct 2014)(Citation: ### Response: T1141.


Instruction: List the MITRE techniques contained in the text.

Input: OSX Keydnap malware) and [PowerShell](https://attack.mitre.org/techniques/T1086)(Citation: LogRhythm

Output: T1141

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: OSX Keydnap malware) and [PowerShell](https://attack.mitre.org/techniques/T1086)(Citation: LogRhythm ### Response: T1141.


Instruction: List the MITRE techniques contained in the text.

Input: Do You Trust Oct 2014)(Citation:

Output: T1141

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Do You Trust Oct 2014)(Citation: ### Response: T1141.


Instruction: List the MITRE techniques contained in the text.

Input: Enigma Phishing for Credentials Jan 2015).

Output: T1141

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enigma Phishing for Credentials Jan 2015). ### Response: T1141.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create and cultivate accounts with services that can be used during targeting.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create and cultivate accounts with services that can be used during targeting. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can create accounts that can be used to build a persona to further operations.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can create accounts that can be used to build a persona to further operations. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: Persona development consists of the development of public information, presence, history and appropriate affiliations.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Persona development consists of the development of public information, presence, history and appropriate affiliations. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: For operations incorporating social engineering, the utilization of an online persona may be important.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For operations incorporating social engineering, the utilization of an online persona may be important. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: These personas may be fictitious or impersonate real people.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These personas may be fictitious or impersonate real people. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.).

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: Establishing a persona may require development of additional documentation to make them seem real.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Establishing a persona may require development of additional documentation to make them seem real. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input:
This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1)

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create accounts with cloud providers that can be used during targeting.

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create accounts with cloud providers that can be used during targeting. ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s.

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure.

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider. ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network.

Output: T1072

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network. ### Response: T1072.


Instruction: List the MITRE techniques contained in the text.

Input: Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, HBSS, Altiris, etc.).

Output: T1072

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, HBSS, Altiris, etc.). ### Response: T1072.


Instruction: List the MITRE techniques contained in the text.

Input: Access to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system.

Output: T1072

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. ### Response: T1072.


Instruction: List the MITRE techniques contained in the text.

Input: The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.

Output: T1072

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints. ### Response: T1072.


Instruction: List the MITRE techniques contained in the text.

Input: Network infrastructure may also have administration tools that can be similarly abused by adversaries.

Output: T1072

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network infrastructure may also have administration tools that can be similarly abused by adversaries. ### Response: T1072.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)

Output: T1072

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation) ### Response: T1072.


Instruction: List the MITRE techniques contained in the text.

Input: The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required.

Output: T1072

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. ### Response: T1072.


Instruction: List the MITRE techniques contained in the text.

Input: However, the system may require an administrative account to log in or to perform it's intended purpose.

Output: T1072

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, the system may require an administrative account to log in or to perform it's intended purpose. ### Response: T1072.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may steal data by exfiltrating it over an existing command and control channel.

Output: T1041

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may steal data by exfiltrating it over an existing command and control channel. ### Response: T1041.


Instruction: List the MITRE techniques contained in the text.

Input: Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Output: T1041

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Stolen data is encoded into the normal communications channel using the same protocol as command and control communications. ### Response: T1041.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: Windows uses access tokens to determine the ownership of a running process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows uses access tokens to determine the ownership of a running process. ### Response: T1134.