Instruction: List the MITRE techniques contained in the text.

Input: This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China) ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: For attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498). ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target the different network services provided by systems to conduct a denial of service (DoS).

Output: T1499.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). ### Response: T1499.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.

Output: T1499.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service. ### Response: T1499.002.


Instruction: List the MITRE techniques contained in the text.

Input: One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it.

Output: T1499.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. ### Response: T1499.002.


Instruction: List the MITRE techniques contained in the text.

Input:
This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood)

Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS.

Output: T1499.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood)

Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. ### Response: T1499.002.


Instruction: List the MITRE techniques contained in the text.

Input: The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections.

Output: T1499.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. ### Response: T1499.002.


Instruction: List the MITRE techniques contained in the text.

Input: If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm.

Output: T1499.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. ### Response: T1499.002.


Instruction: List the MITRE techniques contained in the text.

Input: In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests.

Output: T1499.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. ### Response: T1499.002.


Instruction: List the MITRE techniques contained in the text.

Input: Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)

Output: T1499.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012) ### Response: T1499.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
Supply chain compromise can take place at any stage of the supply chain including:

* Manipulation of development tools
* Manipulation of a development environment
* Manipulation of source code repositories (public or private)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Supply chain compromise can take place at any stage of the supply chain including:

* Manipulation of development tools
* Manipulation of a development environment
* Manipulation of source code repositories (public or private) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
* Manipulation of source code in open-source dependencies
* Manipulation of software update/distribution mechanisms
* Compromised/infected system images (multiple cases of removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Manipulation of source code in open-source dependencies
* Manipulation of software update/distribution mechanisms
* Compromised/infected system images (multiple cases of removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
Replacement of legitimate software with modified versions
*

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Replacement of legitimate software with modified versions
* ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
Sales of modified/counterfeit products to legitimate distributors
*

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sales of modified/counterfeit products to legitimate distributors
* ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
Shipment interdiction

While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation:

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Shipment interdiction

While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation:

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Command Five SK 2011)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Command Five SK 2011) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation:

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Symantec Elderwood Sept 2012)(Citation:

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Symantec Elderwood Sept 2012)(Citation: ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Avast CCleaner3 2018)(Citation: Command Five SK 2011)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Avast CCleaner3 2018)(Citation: Command Five SK 2011) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise.

Output: T1195.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. ### Response: T1195.003.


Instruction: List the MITRE techniques contained in the text.

Input: By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system.

Output: T1195.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. ### Response: T1195.003.


Instruction: List the MITRE techniques contained in the text.

Input: Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.

Output: T1195.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals. ### Response: T1195.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may interact with the native OS application programming interface (API) to execute behaviors. ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API)

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these OS API functions as a means of executing behaviors.

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these OS API functions as a means of executing behaviors. ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls)

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation:

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft CreateProcess)(Citation: GNU Fork)

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft CreateProcess)(Citation: GNU Fork) ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input:
This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)

Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs.

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)

Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation:

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation) ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls)

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001).

Output: T1106

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001). ### Response: T1106.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This may compromise the integrity of security solutions by causing notable events to go unreported.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may compromise the integrity of security solutions by causing notable events to go unreported. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133).

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries. ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Network connection history may be stored in various locations.

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network connection history may be stored in various locations. ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input:
For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):

* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers

Windows may also store information about recent RDP connections in files such as C:\Users\\%username%\Documents\Default.rdp and `C:\Users\%username%\AppData\Local\Microsoft\Terminal
Server Client\Cache\`.(Citation:

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):

* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers

Windows may also store information about recent RDP connections in files such as C:\Users\\%username%\Documents\Default.rdp and `C:\Users\%username%\AppData\Local\Microsoft\Terminal
Server Client\Cache\`.(Citation: ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Moran RDPieces)

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Moran RDPieces) ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input:
Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)

Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090).

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)

Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis. ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos is an authentication protocol widely used in modern Windows domain environments.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos is an authentication protocol widely used in modern Windows domain environments. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The KDC is responsible for both authentication and ticket granting.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The KDC is responsible for both authentication and ticket granting. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input:
On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache".

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache". ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Both files require root access to read.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both files require root access to read. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation:

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation: ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation:

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation: ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002)

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017)

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: Preauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002).

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Preauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002). ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password.

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user.

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: Part of the AS-REP message is signed with the user’s password.(Citation: Microsoft Kerberos Preauth 2014)

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Part of the AS-REP message is signed with the user’s password.(Citation: Microsoft Kerberos Preauth 2014) ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4.

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: The recovered encrypted data may be vulnerable to offline

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The recovered encrypted data may be vulnerable to offline ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Password Cracking](https://attack.mitre.org/techniques/T1110/002

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Password Cracking](https://attack.mitre.org/techniques/T1110/002 ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: ) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials.

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials. ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation:

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: Stealthbits Cracking AS-REP Roasting Jun 2019)

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Stealthbits Cracking AS-REP Roasting Jun 2019) ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter.

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter. ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, the adversary may send an AS-REQ message for each user.

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, the adversary may send an AS-REQ message for each user. ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data.

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation:

Output: T1558.004


Instruction: List the MITRE techniques contained in the text.

Input:
Stealthbits Cracking AS-REP Roasting Jun 2019)

Cracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014)

Output: T1558.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Stealthbits Cracking AS-REP Roasting Jun 2019)

Cracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014) ### Response: T1558.004.


Instruction: List the MITRE techniques contained in the text.

Input: Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services.

Output: T1058

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. ### Response: T1058.


Instruction: List the MITRE techniques contained in the text.

Input: The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1086), or [Reg](https://attack.mitre.org/software/S0075).

Output: T1058

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1086), or [Reg](https://attack.mitre.org/software/S0075). ### Response: T1058.


Instruction: List the MITRE techniques contained in the text.

Input: Access to Registry keys is controlled through Access Control Lists and permissions.

Output: T1058

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access to Registry keys is controlled through Access Control Lists and permissions. ### Response: T1058.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MSDN Registry Key Security)

Output: T1058

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MSDN Registry Key Security) ### Response: T1058.


Instruction: List the MITRE techniques contained in the text.

Input: If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control.

Output: T1058

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. ### Response: T1058.


Instruction: List the MITRE techniques contained in the text.

Input: When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).

Output: T1058

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). ### Response: T1058.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also alter Registry keys associated with service failure parameters (such as FailureCommand) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: TrustedSignal Service Failure)(Citation: Twitter Service Recovery Nov 2017)

Output: T1058

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also alter Registry keys associated with service failure parameters (such as FailureCommand) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: TrustedSignal Service Failure)(Citation: Twitter Service Recovery Nov 2017) ### Response: T1058.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise third-party infrastructure that can be used during targeting.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise third-party infrastructure that can be used during targeting. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation:

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation:

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Use of compromised infrastructure allows adversaries to stage, launch, and execute operations.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing](https://attack.mitre.org/techniques/T1566) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: campaigns.(Citation: FireEye DNS Hijack 2019)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: campaigns.(Citation: FireEye DNS Hijack 2019) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting.

Output: T1584.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. ### Response: T1584.003.


Instruction: List the MITRE techniques contained in the text.

Input: There exist a variety of cloud service providers that will sell virtual machines/containers as a service.

Output: T1584.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There exist a variety of cloud service providers that will sell virtual machines/containers as a service. ### Response: T1584.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise VPSs purchased by third-party entities.

Output: T1584.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise VPSs purchased by third-party entities. ### Response: T1584.003.


Instruction: List the MITRE techniques contained in the text.

Input:
By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)

Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.

Output: T1584.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)

Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party. ### Response: T1584.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Cisco Synful Knock Evolution)

Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes).

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Synful Knock Evolution)

Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can compromise and manipulate devices that perform encryption of network traffic.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can compromise and manipulate devices that perform encryption of network traffic. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Cisco Blog Legacy Device Attacks)

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Blog Legacy Device Attacks) ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution)

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes).

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key.

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key. ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device.

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Cisco Blog Legacy Device Attacks)

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Blog Legacy Device Attacks) ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This may compromise the integrity of security solutions by causing notable events to go unreported.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may compromise the integrity of security solutions by causing notable events to go unreported. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux and macOS, these command histories can be accessed in a few different ways.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux and macOS, these command histories can be accessed in a few different ways. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: The benefit of this is that it allows users to go back to commands they've used before in different sessions.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The benefit of this is that it allows users to go back to commands they've used before in different sessions. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to clear command history data (clear logging and/or clear history).(Citation: US-CERT-TA18-106A)

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to clear command history data (clear logging and/or clear history).(Citation: US-CERT-TA18-106A) ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: The built-in history only tracks the commands used in the current session.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The built-in history only tracks the commands used in the current session. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: This command history is not available to other sessions and is deleted when the session ends.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This command history is not available to other sessions and is deleted when the session ends. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History) ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: This, however, will not delete/flush the ConsoleHost_history.txt file.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This, however, will not delete/flush the ConsoleHost_history.txt file. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics) ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Output: T1202

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. ### Response: T1202.