Instruction: List the MITRE techniques contained in the text.

Input: WebClient).downloadString() and Invoke-WebRequest.

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: WebClient).downloadString() and Invoke-WebRequest. ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas) ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts.

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: Files can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016)

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Files can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems.

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)

Output: T1105

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync) ### Response: T1105.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the Add-MailboxPermission

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the Add-MailboxPermission ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation:

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye APT35 2018)(Citation:

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye APT35 2018)(Citation: ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: Crowdstrike Hiding in Plain Sight 2018)

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Crowdstrike Hiding in Plain Sight 2018) ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation:

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation: ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: Google Ensuring Your Information is Safe)

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Google Ensuring Your Information is Safe) ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also assign mailbox folder permissions through individual folder permissions or roles.

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders.

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.(Citation:

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.(Citation: ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452)

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452) ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise.

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise. ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: This may further enable use of additional techniques for gaining access to systems.

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may further enable use of additional techniques for gaining access to systems. ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation:

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: Bienstock, D. - Defending O365 - 2019)

Output: T1098.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Bienstock, D. - Defending O365 - 2019) ### Response: T1098.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal capabilities that can be used during targeting.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal capabilities that can be used during targeting. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries).

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal code signing certificates that can be used during targeting.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal code signing certificates that can be used during targeting. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also steal code signing materials directly from a compromised third-party.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also steal code signing materials directly from a compromised third-party. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

Output: T1126

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. ### Response: T1126.


Instruction: List the MITRE techniques contained in the text.

Input: Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed.

Output: T1126

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. ### Response: T1126.


Instruction: List the MITRE techniques contained in the text.

Input: [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.

Output: T1126

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. ### Response: T1126.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Technet Net Use)

Output: T1126

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Technet Net Use) ### Response: T1126.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments.

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input: Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers. ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these resources in various ways as a means of executing arbitrary commands.

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. [Resource Hijacking](https://attack.mitre.org/techniques/T1496)).(Citation: Cado Security Denonia)

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. [Resource Hijacking](https://attack.mitre.org/techniques/T1496)).(Citation: Cado Security Denonia) ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also create functions that enable further compromise of the cloud environment.

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also create functions that enable further compromise of the cloud environment. ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input:
For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to a serverless cloud function, which may then be able to perform actions the original user cannot.(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Rhingo Security Labs GCP Privilege Escalation)

Serverless functions can also be invoked in response to cloud events (i.e. [Event Triggered Execution](https://attack.mitre.org/techniques/T1546)), potentially enabling persistent execution over time.

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to a serverless cloud function, which may then be able to perform actions the original user cannot.(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Rhingo Security Labs GCP Privilege Escalation)

Serverless functions can also be invoked in response to cloud events (i.e. [Event Triggered Execution](https://attack.mitre.org/techniques/T1546)), potentially enabling persistent execution over time. ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input: For example, in AWS environments, an adversary may create a Lambda function that automatically adds [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.(Citation: Backdooring an AWS account)

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, in AWS environments, an adversary may create a Lambda function that automatically adds [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.(Citation: Backdooring an AWS account) ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, an adversary may create a Power Automate workflow in Office 365 environments that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.(Citation: Varonis Power Automate Data Exfiltration)(Citation:

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, an adversary may create a Power Automate workflow in Office 365 environments that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.(Citation: Varonis Power Automate Data Exfiltration)(Citation: ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft DART Case Report 001)

Output: T1648

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft DART Case Report 001) ### Response: T1648.


Instruction: List the MITRE techniques contained in the text.

Input: Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.

Output: T1084

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. ### Response: T1084.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.

Output: T1084

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. ### Response: T1084.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension).

Output: T1084

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension). ### Response: T1084.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer's uptime.

Output: T1084

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer's uptime. ### Response: T1084.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Kazanciyan 2014)

Output: T1084

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Kazanciyan 2014) ### Response: T1084.


Instruction: List the MITRE techniques contained in the text.

Input: Several threat groups have reportedly used this technique to maintain persistence.

Output: T1084

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several threat groups have reportedly used this technique to maintain persistence. ### Response: T1084.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Mandiant M-Trends 2015)

Output: T1084

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Mandiant M-Trends 2015) ### Response: T1084.


Instruction: List the MITRE techniques contained in the text.

Input: Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization.

Output: T1160

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. ### Response: T1160.


Instruction: List the MITRE techniques contained in the text.

Input: This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons).

Output: T1160

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). ### Response: T1160.


Instruction: List the MITRE techniques contained in the text.

Input: These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).

Output: T1160

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). ### Response: T1160.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories (Citation: OSX Malware Detection).

Output: T1160

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories (Citation: OSX Malware Detection). ### Response: T1160.


Instruction: List the MITRE techniques contained in the text.

Input: The daemon name may be disguised by using a name from a related operating system or benign software  (Citation: WireLurker).

Output: T1160

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The daemon name may be disguised by using a name from a related operating system or benign software  (Citation: WireLurker). ### Response: T1160.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root.

Output: T1160

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root. ### Response: T1160.


Instruction: List the MITRE techniques contained in the text.

Input: The plist file permissions must be root:wheel, but the script or program that it points to has no such requirement.

Output: T1160

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The plist file permissions must be root:wheel, but the script or program that it points to has no such requirement. ### Response: T1160.


Instruction: List the MITRE techniques contained in the text.

Input: So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon’s executable and gain persistence or Privilege Escalation.

Output: T1160

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon’s executable and gain persistence or Privilege Escalation. ### Response: T1160.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Process injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: These implementations exist for every major OS but are typically platform specific.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These implementations exist for every major OS but are typically platform specific. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: Ptrace system call injection involves attaching to and modifying a running process.

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Ptrace system call injection involves attaching to and modifying a running process. ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute.

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction).

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction). ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018)

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject)

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines.

Output: T1653

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. ### Response: T1653.


Instruction: List the MITRE techniques contained in the text.

Input: When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate)

Output: T1653

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate) ### Response: T1653.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.(Citation: Microsoft: Powercfg command-line options)(Citation: systemdsleep Linux)

Output: T1653

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.(Citation: Microsoft: Powercfg command-line options)(Citation: systemdsleep Linux) ### Response: T1653.


Instruction: List the MITRE techniques contained in the text.

Input: For example, `powercfg` controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.(Citation: Two New Monero Malware Attacks Target Windows and Android Users)

Output: T1653

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, `powercfg` controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.(Citation: Two New Monero Malware Attacks Target Windows and Android Users) ### Response: T1653.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also extend system lock screen timeout settings.(Citation: BATLOADER:

Output: T1653

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also extend system lock screen timeout settings.(Citation: BATLOADER: ### Response: T1653.


Instruction: List the MITRE techniques contained in the text.

Input: The Evasive Downloader Malware)

Output: T1653

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Evasive Downloader Malware) ### Response: T1653.


Instruction: List the MITRE techniques contained in the text.

Input: Other relevant settings, such as disk and hibernate timeout, can be similarly abused to keep the infected machine running even if no user is active.(Citation: CoinLoader: A Sophisticated Malware Loader Campaign)

Output: T1653

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other relevant settings, such as disk and hibernate timeout, can be similarly abused to keep the infected machine running even if no user is active.(Citation: CoinLoader: A Sophisticated Malware Loader Campaign) ### Response: T1653.


Instruction: List the MITRE techniques contained in the text.

Input: Aware that some malware cannot survive system reboots, adversaries may entirely delete files used to invoke system shut down or reboot.(Citation: Condi-Botnet-binaries)

Output: T1653

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Aware that some malware cannot survive system reboots, adversaries may entirely delete files used to invoke system shut down or reboot.(Citation: Condi-Botnet-binaries) ### Response: T1653.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: This is common behavior that can be used across different platforms and the network to evade defenses.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is common behavior that can be used across different platforms and the network to evade defenses. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may be compressed, archived, or encrypted in order to avoid detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may be compressed, archived, or encrypted in order to avoid detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: These payloads may be used during Initial Access or later to mitigate detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These payloads may be used during Initial Access or later to mitigate detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Volexity PowerDuke November 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Volexity PowerDuke November 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use compressed or archived scripts, such as JavaScript.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use compressed or archived scripts, such as JavaScript. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Linux/Cdorked.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Linux/Cdorked. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: A We Live Security Analysis)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A We Live Security Analysis) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Obfuscation Sept 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Obfuscation Sept 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Obfuscation June 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Obfuscation June 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: API functions called by malware may leave static artifacts such as strings in payload files.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: API functions called by malware may leave static artifacts such as strings in payload files. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input:
Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing)

To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing)

To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Various methods may be used to obfuscate malware calls to API functions.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various methods may be used to obfuscate malware calls to API functions. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: For example, hashes of function names are commonly stored in malware in lieu of literal strings.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, hashes of function names are commonly stored in malware in lieu of literal strings. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`.

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`. ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation:

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation: ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash)

Output: T1027.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash) ### Response: T1027.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary may then perform actions as the logged-on user.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary may then perform actions as the logged-on user. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: In an enterprise environment, servers and workstations can be organized into domains.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In an enterprise environment, servers and workstations can be organized into domains. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Management MDM macOS)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Management MDM macOS)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Kickstart Apple Remote Desktop commands)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kickstart Apple Remote Desktop commands)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Apple Remote Desktop Admin Guide 3.3)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple Remote Desktop Admin Guide 3.3) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Lockboxx ARD 2019)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Lockboxx ARD 2019)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Kickstart Apple Remote Desktop commands)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kickstart Apple Remote Desktop commands) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP).

Output: T1021.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). ### Response: T1021.001.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary may then perform actions as the logged-on user.

Output: T1021.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary may then perform actions as the logged-on user. ### Response: T1021.001.


Instruction: List the MITRE techniques contained in the text.

Input: Remote desktop is a common feature in operating systems.

Output: T1021.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote desktop is a common feature in operating systems. ### Response: T1021.001.


Instruction: List the MITRE techniques contained in the text.

Input: It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system.

Output: T1021.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. ### Response: T1021.001.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)

Output: T1021.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) ### Response: T1021.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.

Output: T1021.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. ### Response: T1021.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP.

Output: T1021.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. ### Response: T1021.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)

Output: T1021.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware) ### Response: T1021.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: These scripts can vary based on operating system and whether applied locally or remotely.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These scripts can vary based on operating system and whether applied locally or remotely. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use these scripts to maintain persistence on a single system.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use these scripts to maintain persistence on a single system. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts)

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Registry key.(Citation: Hexacorn Logon Scripts)

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry key.(Citation: Hexacorn Logon Scripts) ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use these scripts to maintain persistence on a single system.

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use these scripts to maintain persistence on a single system. ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Output: T1037.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ### Response: T1037.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Process injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.