Instruction: List the MITRE techniques contained in the text.

Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008),

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574). ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also change permissions of symbolic links.

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also change permissions of symbolic links. ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.(Citation: new_rust_based_ransomware)(Citation: bad_luck_blackcat)(Citation: falconoverwatch_blackcat_attack)(Citation: blackmatter_blackcat)(Citation: fsutil_behavior)

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.(Citation: new_rust_based_ransomware)(Citation: bad_luck_blackcat)(Citation: falconoverwatch_blackcat_attack)(Citation: blackmatter_blackcat)(Citation: fsutil_behavior) ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018)

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018)

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: If a matching entry is found, access to the object is granted.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a matching entry is found, access to the object is granted. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018) ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574). ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: SensePost Ruler GitHub)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SensePost Ruler GitHub) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet O365 Outlook Rules)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet O365 Outlook Rules) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.

Output: T1137.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. ### Response: T1137.006.


Instruction: List the MITRE techniques contained in the text.

Input: Office add-ins can be used to add functionality to Office programs.

Output: T1137.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Office add-ins can be used to add functionality to Office programs. ### Response: T1137.006.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.

Output: T1137.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. ### Response: T1137.006.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)

Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.

Output: T1137.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)

Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts. ### Response: T1137.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application.

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW) ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft transport agents to establish persistent access to systems.

Output: T1505.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft transport agents to establish persistent access to systems. ### Response: T1505.002.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation:

Output: T1505.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ### Response: T1505.002.


Instruction: List the MITRE techniques contained in the text.

Input: ESET LightNeuron May 2019)

Output: T1505.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ESET LightNeuron May 2019) ### Response: T1505.002.


Instruction: List the MITRE techniques contained in the text.

Input: Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server.

Output: T1505.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. ### Response: T1505.002.


Instruction: List the MITRE techniques contained in the text.

Input: Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.

Output: T1505.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks. ### Response: T1505.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.(Citation: ESET LightNeuron May 2019)

Output: T1505.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.(Citation: ESET LightNeuron May 2019) ### Response: T1505.002.


Instruction: List the MITRE techniques contained in the text.

Input: Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria.

Output: T1505.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria. ### Response: T1505.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary.

Output: T1505.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary. ### Response: T1505.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Output: T1082

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. ### Response: T1082.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Output: T1082

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. ### Response: T1082.


Instruction: List the MITRE techniques contained in the text.

Input: Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information.

Output: T1082

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. ### Response: T1082.


Instruction: List the MITRE techniques contained in the text.

Input: If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS.

Output: T1082

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. ### Response: T1082.


Instruction: List the MITRE techniques contained in the text.

Input: As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space.

Output: T1082

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. ### Response: T1082.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. show version).(Citation: US-CERT-TA18-106A)

Output: T1082

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. show version).(Citation: US-CERT-TA18-106A) ### Response: T1082.


Instruction: List the MITRE techniques contained in the text.

Input:
[System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)

Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs.

Output: T1082

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)

Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. ### Response: T1082.


Instruction: List the MITRE techniques contained in the text.

Input: Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)

Output: T1082

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) ### Response: T1082.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

Output: T1071.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. ### Response: T1071.002.


Instruction: List the MITRE techniques contained in the text.

Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Output: T1071.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ### Response: T1071.002.


Instruction: List the MITRE techniques contained in the text.

Input: Protocols such as SMB, FTP, FTPS, and TFTP that transfer files may be very common in environments.

Output: T1071.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Protocols such as SMB, FTP, FTPS, and TFTP that transfer files may be very common in environments. ### Response: T1071.002.


Instruction: List the MITRE techniques contained in the text.

Input: Packets produced from these protocols may have many fields and headers in which data can be concealed.

Output: T1071.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Packets produced from these protocols may have many fields and headers in which data can be concealed. ### Response: T1071.002.


Instruction: List the MITRE techniques contained in the text.

Input: Data could also be concealed within the transferred files.

Output: T1071.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data could also be concealed within the transferred files. ### Response: T1071.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Output: T1071.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ### Response: T1071.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: The DNS protocol serves an administrative function in computer networking and thus may be very common in environments.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: DNS traffic may also be allowed even before network authentication is completed.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DNS traffic may also be allowed even before network authentication is completed. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: DNS packets contain many fields and headers in which data can be concealed.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DNS packets contain many fields and headers in which data can be concealed. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling)

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

Output: T1071.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. ### Response: T1071.003.


Instruction: List the MITRE techniques contained in the text.

Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Output: T1071.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ### Response: T1071.003.


Instruction: List the MITRE techniques contained in the text.

Input: Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments.

Output: T1071.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. ### Response: T1071.003.


Instruction: List the MITRE techniques contained in the text.

Input: Packets produced from these protocols may have many fields and headers in which data can be concealed.

Output: T1071.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Packets produced from these protocols may have many fields and headers in which data can be concealed. ### Response: T1071.003.


Instruction: List the MITRE techniques contained in the text.

Input: Data could also be concealed within the email messages themselves.

Output: T1071.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data could also be concealed within the email messages themselves. ### Response: T1071.003.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Output: T1071.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ### Response: T1071.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

Output: T1071.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. ### Response: T1071.001.


Instruction: List the MITRE techniques contained in the text.

Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Output: T1071.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ### Response: T1071.001.


Instruction: List the MITRE techniques contained in the text.

Input: Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments.

Output: T1071.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. ### Response: T1071.001.


Instruction: List the MITRE techniques contained in the text.

Input: HTTP/S packets have many fields and headers in which data can be concealed.

Output: T1071.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HTTP/S packets have many fields and headers in which data can be concealed. ### Response: T1071.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Output: T1071.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ### Response: T1071.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Output: T1071

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. ### Response: T1071.


Instruction: List the MITRE techniques contained in the text.

Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Output: T1071

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ### Response: T1071.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS.

Output: T1071

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. ### Response: T1071.


Instruction: List the MITRE techniques contained in the text.

Input: For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.

Output: T1071

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP. ### Response: T1071.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may stage collected data in a central location or directory prior to Exfiltration.

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may stage collected data in a central location or directory prior to Exfiltration. ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560).

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017) ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration.

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.

Output: T1074

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection. ### Response: T1074.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration.

Output: T1074.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. ### Response: T1074.002.


Instruction: List the MITRE techniques contained in the text.

Input: Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560).

Output: T1074.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). ### Response: T1074.002.


Instruction: List the MITRE techniques contained in the text.

Input: Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.

Output: T1074.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. ### Response: T1074.002.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration.

Output: T1074.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. ### Response: T1074.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)

Output: T1074.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) ### Response: T1074.002.


Instruction: List the MITRE techniques contained in the text.

Input: By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.

Output: T1074.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection. ### Response: T1074.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system.

Output: T1098.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. ### Response: T1098.006.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023)

Output: T1098.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) ### Response: T1098.006.


Instruction: List the MITRE techniques contained in the text.

Input: Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)

Output: T1098.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC) ### Response: T1098.006.


Instruction: List the MITRE techniques contained in the text.

Input: This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity.

Output: T1098.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. ### Response: T1098.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised.

Output: T1098.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. ### Response: T1098.006.


Instruction: List the MITRE techniques contained in the text.

Input: Note that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based  role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation:

Output: T1098.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Note that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based  role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: ### Response: T1098.006.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Azure Kubernetes Service Service Accounts)

Output: T1098.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Azure Kubernetes Service Service Accounts) ### Response: T1098.006.


Instruction: List the MITRE techniques contained in the text.

Input: In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).

Output: T1098.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003). ### Response: T1098.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques)

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: The cron utility is a time-based job scheduler for Unix-like operating systems.

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The cron utility is a time-based job scheduler for Unix-like operating systems. ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: The <code>

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The <code> ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: crontab</code> file contains the schedule of cron entries to be run and the specified times for execution.

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: Any crontab files are stored in operating system-specific file paths.

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Any crontab files are stored in operating system-specific file paths. ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003).

Output: T1053.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). ### Response: T1053.003.


Instruction: List the MITRE techniques contained in the text.

Input: This technique is deprecated due to the inaccurate usage.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique is deprecated due to the inaccurate usage. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: Other system services are used to interact with launchd rather than launchd being used by itself.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other system services are used to interact with launchd rather than launchd being used by itself. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the Launchd daemon to perform task scheduling for initial or recurring execution of malicious code.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the Launchd daemon to perform task scheduling for initial or recurring execution of malicious code. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: The launchd daemon, native to macOS, is responsible for loading and maintaining services within the operating system.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The launchd daemon, native to macOS, is responsible for loading and maintaining services within the operating system. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons).

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use the launchd daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use the launchd daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: launchd can also be abused to run a process under the context of a specified account.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: launchd can also be abused to run a process under the context of a specified account. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: Daemons, such as launchd, run with the permissions of the root user account, and will operate regardless of which user account is logged in.

Output: T1053.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Daemons, such as launchd, run with the permissions of the root user account, and will operate regardless of which user account is logged in. ### Response: T1053.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: There are multiple ways to access the Task Scheduler in Windows.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are multiple ways to access the Task Scheduler in Windows. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM).

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent)

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent) ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks.

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task)

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments)

Output: T1053.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments) ### Response: T1053.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Systemd timers are unit files with file extension <code>.timer</code> that control services.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd timers are unit files with file extension <code>.timer</code> that control services. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Timers can be set to run on a calendar event or after a time span relative to a starting point.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Timers can be set to run on a calendar event or after a time span relative to a starting point. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020)

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input:
Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)

Each .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)

Each .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation:

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Linux man-pages: systemd January 2014)

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux man-pages: systemd January 2014) ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018)

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Timers installed using privileged paths may be used to maintain root level persistence.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Timers installed using privileged paths may be used to maintain root level persistence. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also install user level timers to achieve user level persistence.(Citation: Falcon Sandbox smp: 28553b3a9d)

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also install user level timers to achieve user level persistence.(Citation: Falcon Sandbox smp: 28553b3a9d) ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code.

Output: T1053.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. ### Response: T1053.007.


Instruction: List the MITRE techniques contained in the text.

Input: Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system.

Output: T1053.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. ### Response: T1053.007.


Instruction: List the MITRE techniques contained in the text.

Input: Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

Output: T1053.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. ### Response: T1053.007.


Instruction: List the MITRE techniques contained in the text.

Input: In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob)

Output: T1053.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) ### Response: T1053.007.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)

Output: T1053.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes) ### Response: T1053.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code.

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date.

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group.

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group. ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux and macOS, [at](https://attack.mitre.org/software/S0110) may be invoked by the superuser as well as any users added to the at.allow file.

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux and macOS, [at](https://attack.mitre.org/software/S0110) may be invoked by the superuser as well as any users added to the at.allow file. ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: If the at.allow file does not exist, the at.deny file is checked.

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the at.allow file does not exist, the at.deny file is checked. ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: Every username not listed in at.deny is allowed to invoke [at](https://attack.mitre.org/software/S0110).

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Every username not listed in at.deny is allowed to invoke [at](https://attack.mitre.org/software/S0110). ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: If the at.deny exists and is empty, global use of [at](https://attack.mitre.org/software/S0110) is permitted.

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the at.deny exists and is empty, global use of [at](https://attack.mitre.org/software/S0110) is permitted. ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: If neither file exists (which is often the baseline) only the superuser is allowed to use [at](https://attack.mitre.org/software/S0110).(Citation:

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If neither file exists (which is often the baseline) only the superuser is allowed to use [at](https://attack.mitre.org/software/S0110).(Citation: ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: Linux at)

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux at) ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [at](https://attack.mitre.org/software/S0110) to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003).

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [at](https://attack.mitre.org/software/S0110) to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). ### Response: T1053.002.