Instruction: List the MITRE techniques contained in the text.

Input: Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Output: T1136.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. ### Response: T1136.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's identity that can be used during targeting.

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's identity that can be used during targeting. ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials.

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials. ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation:

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Forbes GitHub Creds)(Citation:

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Forbes GitHub Creds)(Citation: ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather employee names that can be used during targeting.

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather employee names that can be used during targeting. ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.

Output: T1482

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. ### Response: T1482.


Instruction: List the MITRE techniques contained in the text.

Input: Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts)

Output: T1482

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) ### Response: T1482.


Instruction: List the MITRE techniques contained in the text.

Input: Domain trusts allow the users of the trusted domain to access resources in the trusting domain.

Output: T1482

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain trusts allow the users of the trusted domain to access resources in the trusting domain. ### Response: T1482.


Instruction: List the MITRE techniques contained in the text.

Input: The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts)

Output: T1482

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) ### Response: T1482.


Instruction: List the MITRE techniques contained in the text.

Input: Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)

Output: T1482

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply) ### Response: T1482.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos is an authentication protocol widely used in modern Windows domain environments.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos is an authentication protocol widely used in modern Windows domain environments. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The KDC is responsible for both authentication and ticket granting.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The KDC is responsible for both authentication and ticket granting. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input:
On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache".

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache". ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Both files require root access to read.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both files require root access to read. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation:

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation: ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation:

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation: ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015)

Output: T1558.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) ### Response: T1558.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection)

Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources.

Output: T1558.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection)

Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. ### Response: T1558.001.


Instruction: List the MITRE techniques contained in the text.

Input: Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets)

Output: T1558.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets) ### Response: T1558.001.


Instruction: List the MITRE techniques contained in the text.

Input: The KDC service runs all on domain controllers that are part of an Active Directory domain.

Output: T1558.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The KDC service runs all on domain controllers that are part of an Active Directory domain. ### Response: T1558.001.


Instruction: List the MITRE techniques contained in the text.

Input: KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT)

Output: T1558.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) ### Response: T1558.001.


Instruction: List the MITRE techniques contained in the text.

Input: The KRBTGT password hash may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) and privileged access to a domain controller.

Output: T1558.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The KRBTGT password hash may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) and privileged access to a domain controller. ### Response: T1558.001.


Instruction: List the MITRE techniques contained in the text.

Input: **This technique has been deprecated.

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **This technique has been deprecated. ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001).

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001). ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input:
**

Adversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement.

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **

Adversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: COM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019)

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: COM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019) ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft COM ACL)(Citation:

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft COM ACL)(Citation: ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys)

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: By default, only Administrators may remotely activate and launch COM objects through DCOM.

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, only Administrators may remotely activate and launch COM objects through DCOM. ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse COM for local command and/or payload execution.

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse COM for local command and/or payload execution. ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation:

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation:

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Fireeye Hunting COM June 2019)(Citation:

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Fireeye Hunting COM June 2019)(Citation: ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: ProjectZero File Write EoP Apr 2018)

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ProjectZero File Write EoP Apr 2018) ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use DCOM for lateral movement.

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use DCOM for lateral movement. ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation:

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.

Output: T1175

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document. ### Response: T1175.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: Traffic mirroring is a native feature for some devices, often used for network analysis.

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Traffic mirroring is a native feature for some devices, often used for network analysis. ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device.

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring)

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control.

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: Many cloud-based environments also support traffic mirroring.

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many cloud-based environments also support traffic mirroring. ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP)

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040),

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.

Output: T1020.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary. ### Response: T1020.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

Output: T1020

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. ### Response: T1020.


Instruction: List the MITRE techniques contained in the text.

Input: When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).

Output: T1020

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). ### Response: T1020.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's hosts that can be used during targeting.

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's hosts that can be used during targeting. ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation:

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's client configurations that can be used during targeting.

Output: T1592.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's client configurations that can be used during targeting. ### Response: T1592.004.


Instruction: List the MITRE techniques contained in the text.

Input: Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.

Output: T1592.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. ### Response: T1592.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1592.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1592.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).

Output: T1592.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). ### Response: T1592.004.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1592.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1592.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1592.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1592.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown) ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.

Output: T1562.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. ### Response: T1562.007.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).

Output: T1562.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004). ### Response: T1562.007.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols.

Output: T1562.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. ### Response: T1562.007.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment.

Output: T1562.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment. ### Response: T1562.007.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity, or remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)

Output: T1562.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity, or remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) ### Response: T1562.007.


Instruction: List the MITRE techniques contained in the text.

Input: Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.

Output: T1562.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. ### Response: T1562.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.(Citation:

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.(Citation: ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Infosecinstitute RTLO Technique)

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infosecinstitute RTLO Technique) ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: A common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation:

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky RTLO Cyber Crime)

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky RTLO Cyber Crime) ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal capabilities that can be used during targeting.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal capabilities that can be used during targeting. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries).

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, steal, or download malware that can be used during targeting.

Output: T1588.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, steal, or download malware that can be used during targeting. ### Response: T1588.001.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols.

Output: T1588.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. ### Response: T1588.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.

Output: T1588.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. ### Response: T1588.001.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities.

Output: T1588.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. ### Response: T1588.001.


Instruction: List the MITRE techniques contained in the text.

Input: Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals.

Output: T1588.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. ### Response: T1588.001.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).

Output: T1588.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries). ### Response: T1588.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify component firmware to persist on systems.

Output: T1542.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify component firmware to persist on systems. ### Response: T1542.002.


Instruction: List the MITRE techniques contained in the text.

Input: Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS.

Output: T1542.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. ### Response: T1542.002.


Instruction: List the MITRE techniques contained in the text.

Input: This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking.

Output: T1542.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking. ### Response: T1542.002.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.

Output: T1542.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks. ### Response: T1542.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete files left behind by the actions of their intrusion activity.

Output: T1070.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete files left behind by the actions of their intrusion activity. ### Response: T1070.004.


Instruction: List the MITRE techniques contained in the text.

Input: Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how.

Output: T1070.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. ### Response: T1070.004.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Output: T1070.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. ### Response: T1070.004.


Instruction: List the MITRE techniques contained in the text.

Input: There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016)

Output: T1070.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) ### Response: T1070.004.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of built-in [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) functions include del on Windows and rm or unlink on Linux and macOS.

Output: T1070.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of built-in [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) functions include del on Windows and rm or unlink on Linux and macOS. ### Response: T1070.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify file time attributes to hide new or changes to existing files.

Output: T1070.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify file time attributes to hide new or changes to existing files. ### Response: T1070.006.


Instruction: List the MITRE techniques contained in the text.

Input: Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.

Output: T1070.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. ### Response: T1070.006.


Instruction: List the MITRE techniques contained in the text.

Input: This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.

Output: T1070.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools. ### Response: T1070.006.