Instruction: List the MITRE techniques contained in the text.

Input: Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

Output: T1090.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. ### Response: T1090.001.


Instruction: List the MITRE techniques contained in the text.

Input: By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.

Output: T1090.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems. ### Response: T1090.001.


Instruction: List the MITRE techniques contained in the text.

Input: To disguise the source of malicious traffic, adversaries may chain together multiple proxies.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To disguise the source of malicious traffic, adversaries may chain together multiple proxies. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Onion Routing)

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Onion Routing) ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of network infrastructure, particularly routers, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain within the Wide-Area Network (WAN) of the enterprise.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of network infrastructure, particularly routers, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain within the Wide-Area Network (WAN) of the enterprise. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001), adversaries can add custom code to the affected network devices that will implement onion routing between those nodes.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001), adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: This custom onion routing network will transport the encrypted C2 traffic through the compromised population, allowing adversaries to communicate with any device within the onion routing network.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This custom onion routing network will transport the encrypted C2 traffic through the compromised population, allowing adversaries to communicate with any device within the onion routing network. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method in order to allow the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s WAN.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method in order to allow the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s WAN. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: Protocols such as ICMP may be used as a transport.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Protocols such as ICMP may be used as a transport. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS.

Output: T1090.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. ### Response: T1090.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Fifield Blocking Resistent Communication through domain fronting 2015)

Output: T1090.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) ### Response: T1090.004.


Instruction: List the MITRE techniques contained in the text.

Input: Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header.

Output: T1090.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. ### Response: T1090.004.


Instruction: List the MITRE techniques contained in the text.

Input: If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header.

Output: T1090.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. ### Response: T1090.004.


Instruction: List the MITRE techniques contained in the text.

Input: A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).

Output: T1090.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). ### Response: T1090.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header.

Output: T1090.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. ### Response: T1090.004.


Instruction: List the MITRE techniques contained in the text.

Input: Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.

Output: T1090.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Traffic will appear to be going to domain-x, however the CDN may route it to domain-y. ### Response: T1090.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

Output: T1090.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. ### Response: T1090.002.


Instruction: List the MITRE techniques contained in the text.

Input: Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.

Output: T1090.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. ### Response: T1090.002.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.

Output: T1090.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. ### Response: T1090.002.


Instruction: List the MITRE techniques contained in the text.

Input: External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors.

Output: T1090.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. ### Response: T1090.002.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers.

Output: T1090.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. ### Response: T1090.002.


Instruction: List the MITRE techniques contained in the text.

Input: Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated.

Output: T1090.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. ### Response: T1090.002.


Instruction: List the MITRE techniques contained in the text.

Input: Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.

Output: T1090.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server. ### Response: T1090.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Visual Basic (VB) for execution.

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Visual Basic (VB) for execution. ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API.

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation:

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: VB .NET

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: VB .NET ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: Mar 2020)(Citation:

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mar 2020)(Citation: ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: VB Microsoft)

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: VB Microsoft) ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript.

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host.

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript) ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use VB payloads to execute malicious commands.

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use VB payloads to execute malicious commands. ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).(Citation:

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).(Citation: ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: Default VBS macros Blocking )

Output: T1059.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Default VBS macros Blocking ) ### Response: T1059.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse AppleScript for execution.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse AppleScript for execution. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript)

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: These AppleEvent messages can be sent independently or easily scripted with AppleScript.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These AppleEvent messages can be sent independently or easily scripted with AppleScript. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Scripts can be run from the command-line via osascript /path/to/script or osascript -e "script here".

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripts can be run from the command-line via osascript /path/to/script or osascript -e "script here". ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: AppleScripts can also be executed as plain text shell scripts by adding <code>#!/usr/bin/osascript</code> to the start of the script file.(Citation:

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AppleScripts can also be executed as plain text shell scripts by adding <code>#!/usr/bin/osascript</code> to the start of the script file.(Citation: ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: SentinelOne AppleScript)

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SentinelOne AppleScript) ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: AppleScripts do not need to call osascript to execute.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AppleScripts do not need to call osascript to execute. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: However, they may be executed from within mach-O binaries by using the macOS

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, they may be executed from within mach-O binaries by using the macOS ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Native API](https://attack.mitre.org/techniques/T1106)s NSAppleScript or OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Native API](https://attack.mitre.org/techniques/T1106)s NSAppleScript or OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation:

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: SentinelOne macOS Red Team)

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SentinelOne macOS Red Team) ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs)

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs) ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the Windows command shell for execution.

Output: T1059.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the Windows command shell for execution. ### Response: T1059.003.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems.

Output: T1059.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. ### Response: T1059.003.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands.

Output: T1059.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. ### Response: T1059.003.


Instruction: List the MITRE techniques contained in the text.

Input:
The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows)

Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops.

Output: T1059.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows)

Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. ### Response: T1059.003.


Instruction: List the MITRE techniques contained in the text.

Input: Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Output: T1059.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. ### Response: T1059.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads.

Output: T1059.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. ### Response: T1059.003.


Instruction: List the MITRE techniques contained in the text.

Input: Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel.

Output: T1059.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel. ### Response: T1059.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Unix shell commands and scripts for execution.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Unix shell commands and scripts for execution. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.)

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell)

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Unix shells to execute various commands or payloads.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Unix shells to execute various commands or payloads. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004).

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: CLIs typically contain various permission levels required for different commands.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CLIs typically contain various permission levels required for different commands. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or [SSH](https://attack.mitre.org/techniques/T1021/004).

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or [SSH](https://attack.mitre.org/techniques/T1021/004). ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use the network CLI to change how network devices behave and operate.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use the network CLI to change how network devices behave and operate. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.(Citation: Cisco Synful Knock Evolution)

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.(Citation: Cisco Synful Knock Evolution) ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Python commands and scripts for execution.

Output: T1059.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Python commands and scripts for execution. ### Response: T1059.006.


Instruction: List the MITRE techniques contained in the text.

Input: Python is a very popular scripting/programming language, with capabilities to perform many functions.

Output: T1059.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Python is a very popular scripting/programming language, with capabilities to perform many functions. ### Response: T1059.006.


Instruction: List the MITRE techniques contained in the text.

Input: Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems.

Output: T1059.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. ### Response: T1059.006.


Instruction: List the MITRE techniques contained in the text.

Input: Python code can also be compiled into binary executables.

Output: T1059.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Python code can also be compiled into binary executables. ### Response: T1059.006.


Instruction: List the MITRE techniques contained in the text.

Input: Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

Output: T1059.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors. ### Response: T1059.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse PowerShell commands and scripts for execution.

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse PowerShell commands and scripts for execution. ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell)

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code.

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363),

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation:

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: Github PSAttack)

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Github PSAttack) ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System. ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: Management.

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Management. ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation:

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)

Output: T1059.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014) ### Response: T1059.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse cloud APIs to execute malicious commands.

Output: T1059.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse cloud APIs to execute malicious commands. ### Response: T1059.009.


Instruction: List the MITRE techniques contained in the text.

Input: APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant.

Output: T1059.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. ### Response: T1059.009.


Instruction: List the MITRE techniques contained in the text.

Input: These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006).

Output: T1059.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006). ### Response: T1059.009.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies.

Output: T1059.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies. ### Response: T1059.009.


Instruction: List the MITRE techniques contained in the text.

Input: With proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions.

Output: T1059.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. ### Response: T1059.009.


Instruction: List the MITRE techniques contained in the text.

Input: For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP).

Output: T1059.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). ### Response: T1059.009.


Instruction: List the MITRE techniques contained in the text.

Input: These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.

Output: T1059.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment. ### Response: T1059.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse various implementations of JavaScript for execution.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse various implementations of JavaScript for execution. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS) ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: JScript is the Microsoft implementation of the same scripting standard.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: JScript is the Microsoft implementation of the same scripting standard. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input:
JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: As of OSX 10.10, OSA only supports two languages, JXA and [AppleScript](https://attack.mitre.org/techniques/T1059/002).

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As of OSX 10.10, OSA only supports two languages, JXA and [AppleScript](https://attack.mitre.org/techniques/T1059/002). ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation:

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Apple About Mac Scripting 2016)(Citation:

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple About Mac Scripting 2016)(Citation: ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: SpecterOps JXA 2020)(Citation:

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SpecterOps JXA 2020)(Citation: ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode)

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode) ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse various implementations of JavaScript to execute various behaviors.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse various implementations of JavaScript to execute various behaviors. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027). ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005). ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Powershell Remote Commands)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Powershell Remote Commands)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Cisco IOS Software Integrity Assurance - Command History)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cisco IOS Software Integrity Assurance - Command History)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Shell Execution in Python)

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Shell Execution in Python) ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown) ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: This could include maliciously redirecting(Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW)(Citation: Microsoft About Event Tracing 2018), by tampering settings that control the collection and flow of event telemetry.(Citation:

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This could include maliciously redirecting(Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW)(Citation: Microsoft About Event Tracing 2018), by tampering settings that control the collection and flow of event telemetry.(Citation: ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: Medium Event Tracing Tampering 2018)

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Medium Event Tracing Tampering 2018) ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may modify the `File` value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security to hide their malicious actions in a new or different .evtx log file.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may modify the `File` value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security to hide their malicious actions in a new or different .evtx log file. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input:
This action does not require a system reboot and takes effect immediately.(Citation: disable_win_evt_logging)

ETW interruption can be achieved multiple ways, however most directly by defining conditions using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This action does not require a system reboot and takes effect immediately.(Citation: disable_win_evt_logging)

ETW interruption can be achieved multiple ways, however most directly by defining conditions using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: In Linux environments, adversaries may disable or reconfigure log processing tools such as syslog or nxlog to inhibit detection and monitoring capabilities to facilitate follow on behaviors (Citation: LemonDuck).

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Linux environments, adversaries may disable or reconfigure log processing tools such as syslog or nxlog to inhibit detection and monitoring capabilities to facilitate follow on behaviors (Citation: LemonDuck). ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create an account to maintain access to victim systems.

Output: T1136

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create an account to maintain access to victim systems. ### Response: T1136.


Instruction: List the MITRE techniques contained in the text.

Input: With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Output: T1136

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. ### Response: T1136.


Instruction: List the MITRE techniques contained in the text.

Input: Accounts may be created on the local system or within a domain or cloud tenant.

Output: T1136

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Accounts may be created on the local system or within a domain or cloud tenant. ### Response: T1136.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Output: T1136

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection. ### Response: T1136.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create a domain account to maintain access to victim systems.

Output: T1136.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create a domain account to maintain access to victim systems. ### Response: T1136.002.


Instruction: List the MITRE techniques contained in the text.

Input: Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain.

Output: T1136.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. ### Response: T1136.002.


Instruction: List the MITRE techniques contained in the text.

Input: Domain accounts can cover user, administrator, and service accounts.

Output: T1136.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain accounts can cover user, administrator, and service accounts. ### Response: T1136.002.


Instruction: List the MITRE techniques contained in the text.

Input: With a sufficient level of access, the <code>net user /add

Output: T1136.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With a sufficient level of access, the <code>net user /add ### Response: T1136.002.


Instruction: List the MITRE techniques contained in the text.

Input: /domain</code> command can be used to create a domain account.

Output: T1136.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: /domain</code> command can be used to create a domain account. ### Response: T1136.002.