Instruction: List the MITRE techniques contained in the text.

Input: At this point the process can be suspended then written to, realigned to the injected code, and resumed via <code>

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: At this point the process can be suspended then written to, realigned to the injected code, and resumed via <code> ### Response: T1055.003.


Instruction: List the MITRE techniques contained in the text.

Input: SuspendThread , VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Elastic Process Injection July 2017)

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SuspendThread , VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Elastic Process Injection July 2017) ### Response: T1055.003.


Instruction: List the MITRE techniques contained in the text.

Input: This is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) but targets an existing process rather than creating a process in a suspended state.

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) but targets an existing process rather than creating a process in a suspended state. ### Response: T1055.003.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.003.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.003.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.

Output: T1079

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS. ### Response: T1079.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Various file types have a typical standard format, including how they are encoded and organized.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various file types have a typical standard format, including how they are encoded and organized. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the header of a JPEG file,  is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the header of a JPEG file,  is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001))

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: so that adversaries may move their malware without triggering detections.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: so that adversaries may move their malware without triggering detections. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: A user may not know that a file is malicious due to the benign appearance and file extension.

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user may not know that a file is malicious due to the benign appearance and file extension. ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Polygot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)

Output: T1036.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Polygot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID) ### Response: T1036.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities.

Output: T1036.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. ### Response: T1036.003.


Instruction: List the MITRE techniques contained in the text.

Input: Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing.

Output: T1036.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. ### Response: T1036.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe).

Output: T1036.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). ### Response: T1036.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Elastic Masquerade Ball)

Output: T1036.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Masquerade Ball) ### Response: T1036.003.


Instruction: List the MITRE techniques contained in the text.

Input: An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.

Output: T1036.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. ### Response: T1036.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: F-Secure CozyDuke)

Output: T1036.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: F-Secure CozyDuke) ### Response: T1036.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can hide a program's true filetype by changing the extension of a file.

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can hide a program's true filetype by changing the extension of a file. ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute.

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary).

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back). ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.

Output: T1036.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious. ### Response: T1036.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

Output: T1036.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. ### Response: T1036.004.


Instruction: List the MITRE techniques contained in the text.

Input: Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name.

Output: T1036.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. ### Response: T1036.004.


Instruction: List the MITRE techniques contained in the text.

Input: Many benign tasks and services exist that have commonly associated names.

Output: T1036.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many benign tasks and services exist that have commonly associated names. ### Response: T1036.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.

Output: T1036.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. ### Response: T1036.004.


Instruction: List the MITRE techniques contained in the text.

Input: Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation:

Output: T1036.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: ### Response: T1036.004.


Instruction: List the MITRE techniques contained in the text.

Input: Fysbis Dr Web Analysis)

Output: T1036.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Fysbis Dr Web Analysis) ### Response: T1036.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.(Citation:

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.(Citation: ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Infosecinstitute RTLO Technique)

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infosecinstitute RTLO Technique) ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: A common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation:

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky RTLO Cyber Crime)

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky RTLO Cyber Crime) ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.

Output: T1036.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default. ### Response: T1036.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: This is done for the sake of evading defenses and observation.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is done for the sake of evading defenses and observation. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe).

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use the same icon of the file they are trying to mimic.

Output: T1036.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use the same icon of the file they are trying to mimic. ### Response: T1036.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt).

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt). ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: However, the second extension is the true file type that determines how the file is opened and executed.

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, the second extension is the true file type that determines how the file is opened and executed. ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension)

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension) ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads.

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads. ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code.

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code. ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: Such files often pose as email attachments and allow an adversary to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) into a user’s system via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such files often pose as email attachments and allow an adversary to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) into a user’s system via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: then [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: then [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an executable file attachment named Evil.txt.exe may display as Evil.txt to a user.

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an executable file attachment named Evil.txt.exe may display as Evil.txt to a user. ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input:
The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.(Citation: SOCPrime DoubleExtension)

Common file types, such as text files (.txt, .doc, etc.) and image files (.jpg, .gif, etc.) are typically used as the first extension to appear benign.

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.(Citation: SOCPrime DoubleExtension)

Common file types, such as text files (.txt, .doc, etc.) and image files (.jpg, .gif, etc.) are typically used as the first extension to appear benign. ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.

Output: T1036.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type. ### Response: T1036.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program.

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017) ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002)

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002) ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: , this activity will not result in a valid signature.

Output: T1036.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: , this activity will not result in a valid signature. ### Response: T1036.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity.

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022)

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree.

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit.

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree.

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation:

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: Sandfly BPFDoor 2022)(Citation:

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sandfly BPFDoor 2022)(Citation: ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft XorDdos Linux Stealth 2022)

Output: T1036.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft XorDdos Linux Stealth 2022) ### Response: T1036.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.

Output: T1036

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. ### Response: T1036.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft DART Case Report 001)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft DART Case Report 001) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Malware Persistence on OS X)(Citation: amnesia malware)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware Persistence on OS X)(Citation: amnesia malware) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Elastic Process Injection July 2017)

Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017)

Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb).

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input:
A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:

*

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:

* ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input:
%WINDIR%\AppPatch\sysmain.sdb and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb

Custom databases are stored in:

* %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom

To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: %WINDIR%\AppPatch\sysmain.sdb and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb

Custom databases are stored in:

* %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom

To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress). ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Application Shimming)

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Application Shimming) ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: Shims can also be abused to establish persistence by continuously being invoked by affected programs.

Output: T1546.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Shims can also be abused to establish persistence by continuously being invoked by affected programs. ### Response: T1546.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP).

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: GPP are tools that allow administrators to create domain policies with embedded credentials.

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GPP are tools that allow administrators to create domain policies with embedded credentials. ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: These policies allow administrators to set local accounts.(Citation:

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These policies allow administrators to set local accounts.(Citation: ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft GPP 2016)

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft GPP 2016) ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: These group policies are stored in SYSVOL on a domain controller.

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These group policies are stored in SYSVOL on a domain controller. ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key)

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key) ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files: ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input:
* Metasploit’s post exploitation module: post/windows/gather/credentials/gpp
* Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword)
* gpprefdecrypt.py

On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Metasploit’s post exploitation module: post/windows/gather/credentials/gpp
* Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword)
* gpprefdecrypt.py

On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: .xml</code>

Output: T1552.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: .xml</code> ### Response: T1552.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation:

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows.

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia) ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: When a device is registered to Azure AD, a device key and a transport key are generated and used to verify the device’s identity.(Citation:

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a device is registered to Azure AD, a device key and a transport key are generated and used to verify the device’s identity.(Citation: ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Primary Refresh Token)

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Primary Refresh Token) ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input:
An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)

On network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys)

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)

On network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys) ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: Some private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line.

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email.

Output: T1552.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. ### Response: T1552.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather credentials via APIs within a containers environment.

Output: T1552.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather credentials via APIs within a containers environment. ### Response: T1552.007.


Instruction: List the MITRE techniques contained in the text.

Input: APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation:

Output: T1552.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: ### Response: T1552.007.


Instruction: List the MITRE techniques contained in the text.

Input: Docker API)(Citation: Kubernetes API)

Output: T1552.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Docker API)(Citation: Kubernetes API) ### Response: T1552.007.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons)

Output: T1552.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) ### Response: T1552.007.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server.

Output: T1552.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. ### Response: T1552.007.


Instruction: List the MITRE techniques contained in the text.

Input: These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.

Output: T1552.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components. ### Response: T1552.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: CG 2014)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: CG 2014) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: SRD GPP)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SRD GPP) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: They may also be found as parameters to deployment commands in container logs.(Citation:

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also be found as parameters to deployment commands in container logs.(Citation: ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: Unit 42 Unsecured Docker Daemons)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit 42 Unsecured Docker Daemons) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)

Output: T1552.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage) ### Response: T1552.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search the Registry on compromised systems for insecurely stored credentials.

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search the Registry on compromised systems for insecurely stored credentials. ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Registry stores configuration information that can be used by the system or other programs.

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Registry stores configuration information that can be used by the system or other programs. ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services.

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes these credentials are used for automatic logons.

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes these credentials are used for automatic logons. ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

* Local Machine Hive: <code>reg query HKLM /f password /t

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

* Local Machine Hive: <code>reg query HKLM /f password /t ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input:
REG_SZ /s</code>
*

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: REG_SZ /s</code>
* ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: Current User Hive: <code>reg query HKCU /f

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Current User Hive: <code>reg query HKCU /f ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: password /t

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: password /t ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: REG_SZ /s</code>

Output: T1552.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: REG_SZ /s</code> ### Response: T1552.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search the bash command history on compromised systems for insecurely stored credentials. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Bash keeps track of the commands users type on the command-line with the "history" utility.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Bash keeps track of the commands users type on the command-line with the "history" utility. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Once a user logs out, the history is flushed to the user’s <code>.bash_history</code> file.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once a user logs out, the history is flushed to the user’s <code>.bash_history</code> file. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: For each user, this file resides at the same location: <code>~/.bash_history</code>.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For each user, this file resides at the same location: <code>~/.bash_history</code>. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, this file keeps track of the user’s last 500 commands.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, this file keeps track of the user’s last 500 commands. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse this by looking through the file for potential credentials.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse this by looking through the file for potential credentials. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: External to DA, the OS X Way)

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: External to DA, the OS X Way) ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may directly collect unsecured credentials stored or passed through user communication services.

Output: T1552.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may directly collect unsecured credentials stored or passed through user communication services. ### Response: T1552.008.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication.

Output: T1552.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. ### Response: T1552.008.


Instruction: List the MITRE techniques contained in the text.

Input: Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.

Output: T1552.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. ### Response: T1552.008.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services.

Output: T1552.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. ### Response: T1552.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials.

Output: T1552.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. ### Response: T1552.008.