Instruction: List the MITRE techniques contained in the text.

Input:
Once enumerated, the target processes’ memory map within <code>/proc/[pid]/maps</code> can be overwritten using dd.(Citation: Uninformed Needle)(Citation: GDS Linux Injection)(Citation: DD Man)

Other techniques such as [Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) may be used to populate a target process with more available gadgets.

Output: T1055.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once enumerated, the target processes’ memory map within <code>/proc/[pid]/maps</code> can be overwritten using dd.(Citation: Uninformed Needle)(Citation: GDS Linux Injection)(Citation: DD Man)

Other techniques such as [Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) may be used to populate a target process with more available gadgets. ### Response: T1055.009.


Instruction: List the MITRE techniques contained in the text.

Input:
Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), proc memory injection may target child processes (such as a backgrounded copy of sleep).(Citation: GDS Linux Injection)

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), proc memory injection may target child processes (such as a backgrounded copy of sleep).(Citation: GDS Linux Injection)

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.009.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via proc memory injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via proc memory injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.009.


Instruction: List the MITRE techniques contained in the text.

Input: Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system.

Output: T1223

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. ### Response: T1223.


Instruction: List the MITRE techniques contained in the text.

Input: CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018)

Output: T1223

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) ### Response: T1223.


Instruction: List the MITRE techniques contained in the text.

Input: CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe).

Output: T1223

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). ### Response: T1223.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft HTML Help Executable Program)

Output: T1223

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft HTML Help Executable Program) ### Response: T1223.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse this technology to conceal malicious code.

Output: T1223

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse this technology to conceal malicious code. ### Response: T1223.


Instruction: List the MITRE techniques contained in the text.

Input: A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1223

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1223.


Instruction: List the MITRE techniques contained in the text.

Input: CHM execution may also bypass application whitelisting on older and/or unpatched systems that do not account for execution of binaries through hh.exe.

Output: T1223

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM execution may also bypass application whitelisting on older and/or unpatched systems that do not account for execution of binaries through hh.exe. ### Response: T1223.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)

Output: T1223

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017) ### Response: T1223.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase or otherwise acquire an existing access to a target system or network.

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase or otherwise acquire an existing access to a target system or network. ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of online services and initial access broker networks are available to sell access to previously compromised systems.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)(Citation: Krebs Access Brokers Fortune 500)

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of online services and initial access broker networks are available to sell access to previously compromised systems.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)(Citation: Krebs Access Brokers Fortune 500) ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input:
In some cases, adversary groups may form partnerships to share compromised systems with each other.(Citation: CISA Karakurt 2022)

Footholds to compromised systems may take a variety of forms, such as access to planted backdoors (e.g., [Web Shell](https://attack.mitre.org/techniques/T1505/003)) or established access via [External Remote Services](https://attack.mitre.org/techniques/T1133).

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversary groups may form partnerships to share compromised systems with each other.(Citation: CISA Karakurt 2022)

Footholds to compromised systems may take a variety of forms, such as access to planted backdoors (e.g., [Web Shell](https://attack.mitre.org/techniques/T1505/003)) or established access via [External Remote Services](https://attack.mitre.org/techniques/T1133). ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, access brokers will implant compromised systems with a “load” that can be used to install additional malware for paying customers.(Citation: Microsoft Ransomware as a Service)

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, access brokers will implant compromised systems with a “load” that can be used to install additional malware for paying customers.(Citation: Microsoft Ransomware as a Service) ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: By leveraging existing access broker networks rather than developing or obtaining their own initial access capabilities, an adversary can potentially reduce the resources required to gain a foothold on a target network and focus their efforts on later stages of compromise.

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By leveraging existing access broker networks rather than developing or obtaining their own initial access capabilities, an adversary can potentially reduce the resources required to gain a foothold on a target network and focus their efforts on later stages of compromise. ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may prioritize acquiring access to systems that have been determined to lack security monitoring or that have high privileges, or systems that belong to organizations in a particular sector.(Citation:

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may prioritize acquiring access to systems that have been determined to lack security monitoring or that have high privileges, or systems that belong to organizations in a particular sector.(Citation: ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers) ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, purchasing access to an organization in sectors such as IT contracting, software development, or telecommunications may allow an adversary to compromise additional victims via a [Trusted Relationship](https://attack.mitre.org/techniques/T1199),

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, purchasing access to an organization in sectors such as IT contracting, software development, or telecommunications may allow an adversary to compromise additional victims via a [Trusted Relationship](https://attack.mitre.org/techniques/T1199), ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: [Multi-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111), or even [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195).

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Multi-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111), or even [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195). ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: **Note:** while this technique is distinct from other behaviors such as [Purchase Technical Data](https://attack.mitre.org/techniques/T1597/002) and [Credentials](https://attack.mitre.org/techniques/T1589/001), they may often be used in conjunction (especially where the acquired foothold requires [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1650

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **Note:** while this technique is distinct from other behaviors such as [Purchase Technical Data](https://attack.mitre.org/techniques/T1597/002) and [Credentials](https://attack.mitre.org/techniques/T1589/001), they may often be used in conjunction (especially where the acquired foothold requires [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1650.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.

Output: T1601

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. ### Response: T1601.


Instruction: List the MITRE techniques contained in the text.

Input: On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.

Output: T1601

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. ### Response: T1601.


Instruction: List the MITRE techniques contained in the text.

Input: To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it.

Output: T1601

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. ### Response: T1601.


Instruction: List the MITRE techniques contained in the text.

Input: This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.

Output: T1601

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device. ### Response: T1601.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits)

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: To change the operating system in storage, the adversary will typically use the standard procedures available to device operators.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: To change the operating system in memory, the adversary typically can use one of two methods.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To change the operating system in memory, the adversary typically can use one of two methods. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: This method typically requires administrative level access to the device.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method typically requires administrative level access to the device. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: In the second method for changing the operating system in memory, the adversary would make use of the boot loader.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the second method for changing the operating system in memory, the adversary would make use of the boot loader. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of existing defenses that can be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600), authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004), and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599).

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of existing defenses that can be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600), authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004), and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599). ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adding new capabilities for the adversary’s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001),

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adding new capabilities for the adversary’s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001), ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port Knocking](https://attack.mitre.org/techniques/T1205/001).

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port Knocking](https://attack.mitre.org/techniques/T1205/001). ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: When this method is used in conjunction with [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When this method is used in conjunction with [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: When the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005).

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005). ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: However, live memory modification of the operating system can be combined with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve persistence.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, live memory modification of the operating system can be combined with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve persistence. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos is an authentication protocol widely used in modern Windows domain environments.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos is an authentication protocol widely used in modern Windows domain environments. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The KDC is responsible for both authentication and ticket granting.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The KDC is responsible for both authentication and ticket granting. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input:
On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache".

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache". ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Both files require root access to read.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both files require root access to read. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation:

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation: ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation:

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation: ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets.

Output: T1558.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. ### Response: T1558.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets)

Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets)

Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).

Output: T1558.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets)

Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets)

Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003). ### Response: T1558.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage code repositories to collect valuable information.

Output: T1213.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage code repositories to collect valuable information. ### Response: T1213.003.


Instruction: List the MITRE techniques contained in the text.

Input: Code repositories are tools/services that store source code and automate software builds.

Output: T1213.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code repositories are tools/services that store source code and automate software builds. ### Response: T1213.003.


Instruction: List the MITRE techniques contained in the text.

Input: They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket.

Output: T1213.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. ### Response: T1213.003.


Instruction: List the MITRE techniques contained in the text.

Input: Users typically interact with code repositories through a web application or command-line utilities such as git.

Output: T1213.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users typically interact with code repositories through a web application or command-line utilities such as git. ### Response: T1213.003.


Instruction: List the MITRE techniques contained in the text.

Input: Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or credentials contained within software's source code.

Output: T1213.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or credentials contained within software's source code. ### Response: T1213.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe)

**Note:**

Output: T1213.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe)

**Note:** ### Response: T1213.003.


Instruction: List the MITRE techniques contained in the text.

Input: This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1593/003), which focuses on conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043) via public code repositories.

Output: T1213.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1593/003), which focuses on conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043) via public code repositories. ### Response: T1213.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage the SharePoint repository as a source to mine valuable information.

Output: T1213.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage the SharePoint repository as a source to mine valuable information. ### Response: T1213.002.


Instruction: List the MITRE techniques contained in the text.

Input: SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems.

Output: T1213.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. ### Response: T1213.002.


Instruction: List the MITRE techniques contained in the text.

Input:
For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

*

Output: T1213.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

* ### Response: T1213.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Policies, procedures, and standards
* Physical / logical network diagrams
*

Output: T1213.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Policies, procedures, and standards
* Physical / logical network diagrams
* ### Response: T1213.002.


Instruction: List the MITRE techniques contained in the text.

Input:
System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
*

Output: T1213.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* ### Response: T1213.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Source code snippets
* Links to network shares and other internal resources

Output: T1213.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Source code snippets
* Links to network shares and other internal resources ### Response: T1213.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage Confluence repositories to mine valuable information.

Output: T1213.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage Confluence repositories to mine valuable information. ### Response: T1213.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:

* Policies, procedures, and standards
* Physical / logical network diagrams
*

Output: T1213.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:

* Policies, procedures, and standards
* Physical / logical network diagrams
* ### Response: T1213.001.


Instruction: List the MITRE techniques contained in the text.

Input:
System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
*

Output: T1213.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* ### Response: T1213.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Source code snippets
* Links to network shares and other internal resources

Output: T1213.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Source code snippets
* Links to network shares and other internal resources ### Response: T1213.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage information repositories to mine valuable information.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage information repositories to mine valuable information. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

*

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

* ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
Policies, procedures, and standards
* Physical / logical network diagrams
*

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Policies, procedures, and standards
* Physical / logical network diagrams
* ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
*

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
Source code snippets
* Links to network shares and other internal resources

Information stored in a repository may vary based on the specific instance or environment.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Source code snippets
* Links to network shares and other internal resources

Information stored in a repository may vary based on the specific instance or environment. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Specific common information repositories include web-based platforms such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) and [Confluence](https://attack.mitre.org/techniques/T1213/001), specific services such as Code Repositories, IaaS databases, enterprise databases, and other storage infrastructure such as SQL Server.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific common information repositories include web-based platforms such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) and [Confluence](https://attack.mitre.org/techniques/T1213/001), specific services such as Code Repositories, IaaS databases, enterprise databases, and other storage infrastructure such as SQL Server. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This may compromise the integrity of security solutions by causing notable events to go unreported.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may compromise the integrity of security solutions by causing notable events to go unreported. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112),

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm)

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation:

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: Talos - Cisco Attack 2022)

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos - Cisco Attack 2022) ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation:

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: NCC Group Team9 June 2020)

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NCC Group Team9 June 2020) ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: These logs can be accessed in a few different ways.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These logs can be accessed in a few different ways. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: The benefit of this is that it allows users to go back to commands they've used before in different sessions.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The benefit of this is that it allows users to go back to commands they've used before in different sessions. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: Since everything typed on the command-line is saved, passwords passed in on the command line are also saved.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since everything typed on the command-line is saved, passwords passed in on the command line are also saved. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse this by searching these files for cleartext passwords.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse this by searching these files for cleartext passwords. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as unset HISTFILE, export HISTFILESIZE=0, history -c, rm ~/.bash_history.

Output: T1146

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as unset HISTFILE, export HISTFILESIZE=0, history -c, rm ~/.bash_history. ### Response: T1146.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for common password storage locations to obtain user credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for common password storage locations to obtain user credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire credentials from the Windows Credential Manager.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire credentials from the Windows Credential Manager. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker) ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Credential Manager separates website credentials from application or network credentials in two lockers.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Credential Manager separates website credentials from application or network credentials in two lockers. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Application and network credentials are stored in the Windows Credentials locker.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Application and network credentials are stored in the Windows Credentials locker. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation:

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Malwarebytes The Windows Vault)

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malwarebytes The Windows Vault) ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.(Citation:

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.(Citation: ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager) ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also obtain credentials from credential backups.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also obtain credentials from credential backups. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI.

Password recovery tools may also obtain plain text passwords from the Credential Manager.(Citation:

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI.

Password recovery tools may also obtain plain text passwords from the Credential Manager.(Citation: ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Malwarebytes The Windows Vault)

Output: T1555.004


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers.

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action.

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: The rule files are in the plist format and define the name, event type, and action to take.

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The rule files are in the plist format and define the name, event type, and action to take. ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: Some examples of event types include system startup and user authentication.

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some examples of event types include system startup and user authentication. ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of actions are to run a system command or send an email.

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of actions are to run a system command or send an email. ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation:

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1160) service.

Output: T1519

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1160) service. ### Response: T1519.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing via service is a specific variant of spearphishing.

Output: T1194

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing via service is a specific variant of spearphishing. ### Response: T1194.


Instruction: List the MITRE techniques contained in the text.

Input: It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Output: T1194

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. ### Response: T1194.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1194

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1194.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.

Output: T1194

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. ### Response: T1194.