Instruction: List the MITRE techniques contained in the text.

Input: User accounts start with a RID of 1,000+.

Output: T1003.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: User accounts start with a RID of 1,000+. ### Response: T1003.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation:

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets.

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry.

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets) ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017)

Output: T1003.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) ### Response: T1003.006.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.

Output: T1003.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. ### Response: T1003.006.


Instruction: List the MITRE techniques contained in the text.

Input: Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators.

Output: T1003.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. ### Response: T1003.006.


Instruction: List the MITRE techniques contained in the text.

Input: The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation:

Output: T1003.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: ### Response: T1003.006.


Instruction: List the MITRE techniques contained in the text.

Input: InsiderThreat ChangeNTLM July 2017)

Output: T1003.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: InsiderThreat ChangeNTLM July 2017) ### Response: T1003.006.


Instruction: List the MITRE techniques contained in the text.

Input: DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation:

Output: T1003.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: ### Response: T1003.006.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft NRPC Dec 2017)

Output: T1003.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft NRPC Dec 2017) ### Response: T1003.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather credentials from the proc filesystem or `/proc`.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather credentials from the proc filesystem or `/proc`. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation:

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: baeldung Linux proc map 2022)

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: baeldung Linux proc map 2022) ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns that are indicative of credentials, such as looking for fixed strings in memory structures or cached hashes.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns that are indicative of credentials, such as looking for fixed strings in memory structures or cached hashes. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: When running without privileged access, processes can still view their own virtual memory locations.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When running without privileged access, processes can still view their own virtual memory locations. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: Some services or programs may save credentials in clear text inside the process’s memory.(Citation: MimiPenguin GitHub May 2017)(Citation:

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some services or programs may save credentials in clear text inside the process’s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: Polop Linux PrivEsc Gitbook)

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Polop Linux PrivEsc Gitbook) ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located.

Output: T1003.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located. ### Response: T1003.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input: By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory)

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory) ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015)

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015) ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input: The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input:
* Volume Shadow Copy
* secretsdump.py
* Using the in-built Windows tool, ntdsutil.exe
* Invoke-NinjaCopy

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Volume Shadow Copy
* secretsdump.py
* Using the in-built Windows tool, ntdsutil.exe
* Invoke-NinjaCopy ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)

Output: T1003.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds) ### Response: T1003.005.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache)

Output: T1003.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) ### Response: T1003.005.


Instruction: List the MITRE techniques contained in the text.

Input: The number of default cached credentials varies and can be altered per system.

Output: T1003.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The number of default cached credentials varies and can be altered per system. ### Response: T1003.005.


Instruction: List the MITRE techniques contained in the text.

Input:
This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache)

With SYSTEM access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py can be used to extract the cached credentials.

Output: T1003.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache)

With SYSTEM access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py can be used to extract the cached credentials. ### Response: T1003.005.


Instruction: List the MITRE techniques contained in the text.

Input: Note: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache)

Output: T1003.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Note: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache) ### Response: T1003.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550). ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input:
For example, on the target host use procdump:

* procdump -ma lsass.exe lsass_dump

Locally, mimikatz can be run using:

* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords

Built-in Windows tools such as comsvcs.dll can also be used:

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on the target host use procdump:

* procdump -ma lsass.exe lsass_dump

Locally, mimikatz can be run using:

* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords

Built-in Windows tools such as comsvcs.dll can also be used: ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: * rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID  lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation:

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID  lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Symantec Attacks Against Government Sector)

Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Symantec Attacks Against Government Sector)

Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014) ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input:
The following SSPs can be used to access credentials:

*

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following SSPs can be used to access credentials:

* ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation:

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Blogs Credential Protection)

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet Blogs Credential Protection) ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: * CredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation:

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * CredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Blogs Credential Protection)

Output: T1003.001


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking.

Output: T1003.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. ### Response: T1003.008.


Instruction: List the MITRE techniques contained in the text.

Input: Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow.

Output: T1003.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow. ### Response: T1003.008.


Instruction: List the MITRE techniques contained in the text.

Input:
By default, <code>/etc/shadow</code> is only readable by the root user.(Citation: Linux Password and Shadow File Formats)

The Linux utility, unshadow, can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper:(Citation:

Output: T1003.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, <code>/etc/shadow</code> is only readable by the root user.(Citation: Linux Password and Shadow File Formats)

The Linux utility, unshadow, can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper:(Citation: ### Response: T1003.008.


Instruction: List the MITRE techniques contained in the text.

Input: nixCraft - John the Ripper) <code># /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db</code>

Output: T1003.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: nixCraft - John the Ripper) <code># /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db</code> ### Response: T1003.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Additional custom tools likely exist as well.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional custom tools likely exist as well. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute malicious payloads via loading shared modules.

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute malicious payloads via loading shared modules. ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)).

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)). ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system.

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective. ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: The Linux & macOS module loader can load and execute shared objects from arbitrary local paths.

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`.

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: Although macOS can execute `.so` files, common practice uses `.dylib` files.(Citation: Apple Dev Dynamic Libraries)(Citation: Linux Shared Libraries)(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: Unit42 OceanLotus 2017)

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although macOS can execute `.so` files, common practice uses `.dylib` files.(Citation: Apple Dev Dynamic Libraries)(Citation: Linux Shared Libraries)(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: Unit42 OceanLotus 2017) ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths.

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: This functionality resides in `NTDLL.dll` and is part of the Windows

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This functionality resides in `NTDLL.dll` and is part of the Windows ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like `LoadLibrary` at run time.(Citation: Microsoft DLL)

Output: T1129

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like `LoadLibrary` at run time.(Citation: Microsoft DLL) ### Response: T1129.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may access network configuration files to collect sensitive data about the device and the network.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may access network configuration files to collect sensitive data about the device and the network. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: The network configuration is a file containing parameters that determine the operation of the device.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The network configuration is a file containing parameters that determine the operation of the device. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID).

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables.

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation:

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: SANS Information Security Reading Room

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SANS Information Security Reading Room ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: Securing SNMP Securing SNMP).

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Securing SNMP Securing SNMP). ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: The MIB may also contain device operational information, including running configuration, routing table, and interface details.

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The MIB may also contain device operational information, including running configuration, routing table, and interface details. ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may collect data related to managed devices from configuration repositories.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may collect data related to managed devices from configuration repositories. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Configuration repositories may also facilitate remote access and administration of devices.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Configuration repositories may also facilitate remote access and administration of devices. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target these repositories in order to collect large quantities of sensitive system administration data.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017) ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: With direct write access to a disk, adversaries may attempt to overwrite portions of disk data.

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR).

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: A complete wipe of all disk sectors may be attempted.

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A complete wipe of all disk sectors may be attempted. ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078),

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input:
[OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)

On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco)

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)

On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco) ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation:

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky StoneDrill 2017)(Citation:

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky StoneDrill 2017)(Citation: ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Unit 42 Shamoon3 2018)

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit 42 Shamoon3 2018) ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk.

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable.

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped.

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped. ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input:
On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco)

To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation:

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco)

To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky StoneDrill 2017)

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky StoneDrill 2017) ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Network DoS can be performed by exhausting the network bandwidth services rely on.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network DoS can be performed by exhausting the network bandwidth services rely on. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Example resources include specific websites, email services, DNS, and web-based applications.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example resources include specific websites, email services, DNS, and web-based applications. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: For DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499).

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499). ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: This DoS attack may also reduce the availability and functionality of the targeted system(s) and network.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001)s are when one or more systems are used to send a high-volume of network packets towards the targeted service's network.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001)s are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: Almost any network protocol may be used for flooding.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Almost any network protocol may be used for flooding. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: Botnets are commonly used to conduct network flooding attacks against networks and services.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Botnets are commonly used to conduct network flooding attacks against networks and services. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: Large botnets can generate a significant amount of traffic from systems spread across the global Internet.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Large botnets can generate a significant amount of traffic from systems spread across the global Internet. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: In some of the worst cases for distributed DoS (DDoS), so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some of the worst cases for distributed DoS (DDoS), so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult.

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)

Output: T1498.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016) ### Response: T1498.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018)

Output: T1492

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) ### Response: T1492.


Instruction: List the MITRE techniques contained in the text.

Input: By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Output: T1492

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. ### Response: T1492.


Instruction: List the MITRE techniques contained in the text.

Input: Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats.

Output: T1492

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. ### Response: T1492.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary.

Output: T1492

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. ### Response: T1492.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1492

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1492.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: How the operating system locates libraries to be used by a program can also be intercepted.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: How the operating system locates libraries to be used by a program can also be intercepted. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line.

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line. ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can place a malicious program in an earlier entry in the list of directories stored in the PATH environment variable, resulting in the operating system executing the malicious binary rather than the legitimate binary when it searches sequentially through that PATH listing.

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can place a malicious program in an earlier entry in the list of directories stored in the PATH environment variable, resulting in the operating system executing the malicious binary rather than the legitimate binary when it searches sequentially through that PATH listing. ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: For example, on Windows if an adversary places a malicious program named "net.exe" in `C:\example path`, which by default precedes `C:\Windows\system32\net.exe` in the PATH environment variable, when "net" is executed from the command-line the `C:\example path` will be called instead of the system's legitimate executable at `C:\Windows\system32\net.exe`.

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on Windows if an adversary places a malicious program named "net.exe" in `C:\example path`, which by default precedes `C:\Windows\system32\net.exe` in the PATH environment variable, when "net" is executed from the command-line the `C:\example path` will be called instead of the system's legitimate executable at `C:\Windows\system32\net.exe`. ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: Some methods of executing a program rely on the PATH environment variable to determine the locations that are searched when the path for the program is not given, such as executing programs from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation:

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some methods of executing a program rely on the PATH environment variable to determine the locations that are searched when the path for the program is not given, such as executing programs from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: ExpressVPN PATH env Windows 2021)

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ExpressVPN PATH env Windows 2021) ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also directly modify the $PATH variable specifying the directories to be searched.

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also directly modify the $PATH variable specifying the directories to be searched. ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can modify the `$PATH` variable to point to a directory they have write access.

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can modify the `$PATH` variable to point to a directory they have write access. ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: When a program using the $PATH variable is called, the OS searches the specified directory and executes the malicious binary.

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a program using the $PATH variable is called, the OS searches the specified directory and executes the malicious binary. ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: On macOS, this can also be performed through modifying the $HOME variable.

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On macOS, this can also be performed through modifying the $HOME variable. ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: These variables can be modified using the command-line, launchctl, [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or modifying the `/etc/paths.d` folder contents.(Citation: uptycs Fake POC linux malware 2023)(Citation:

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These variables can be modified using the command-line, launchctl, [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or modifying the `/etc/paths.d` folder contents.(Citation: uptycs Fake POC linux malware 2023)(Citation: ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: nixCraft macOS PATH variables)(Citation: Elastic Rules macOS launchctl 2022)

Output: T1574.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: nixCraft macOS PATH variables)(Citation: Elastic Rules macOS launchctl 2022) ### Response: T1574.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage information repositories to mine valuable information.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage information repositories to mine valuable information. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

*

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

* ### Response: T1213.