Instruction: List the MITRE techniques contained in the text.

Input: By default, Word has a Normal.dotm template created that can be modified to include a malicious macro.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation:

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019)

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Word Normal.dotm

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Word Normal.dotm ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input:
location:

C:\Users\<username>\AppData\Roaming\Microsoft\Templates\Normal.dotm

Excel Personal.xlsb

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: location:

C:\Users\<username>\AppData\Roaming\Microsoft\Templates\Normal.dotm

Excel Personal.xlsb ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input:
location:

C:\Users\<username>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB

Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\Program Files (x86)\Microsoft Office\root\Office16\, or by modifying the GlobalDotName registry key.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: location:

C:\Users\<username>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB

Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\Program Files (x86)\Microsoft Office\root\Office16\, or by modifying the GlobalDotName registry key. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019)

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system.

Output: T1137.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. ### Response: T1137.004.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders.

Output: T1137.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. ### Response: T1137.004.


Instruction: List the MITRE techniques contained in the text.

Input: This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened.

Output: T1137.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. ### Response: T1137.004.


Instruction: List the MITRE techniques contained in the text.

Input: A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)

Output: T1137.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) ### Response: T1137.004.


Instruction: List the MITRE techniques contained in the text.

Input: Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started.

Output: T1137.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. ### Response: T1137.004.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)

Output: T1137.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page) ### Response: T1137.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system.

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook forms are used as templates for presentation and functionality in Outlook messages.

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook forms are used as templates for presentation and functionality in Outlook messages. ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation:

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: SensePost Outlook Forms)

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SensePost Outlook Forms) ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started.

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms) ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.

Output: T1137.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. ### Response: T1137.006.


Instruction: List the MITRE techniques contained in the text.

Input: Office add-ins can be used to add functionality to Office programs.

Output: T1137.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Office add-ins can be used to add functionality to Office programs. ### Response: T1137.006.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.

Output: T1137.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. ### Response: T1137.006.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)

Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.

Output: T1137.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)

Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts. ### Response: T1137.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system.

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook rules allow a user to define automated behavior to manage email messages.

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook rules allow a user to define automated behavior to manage email messages. ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender.

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules) ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started.

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules) ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: SensePost Ruler GitHub)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SensePost Ruler GitHub) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet O365 Outlook Rules)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet O365 Outlook Rules) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MSDN InstallUtil)

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MSDN InstallUtil) ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: NET\Framework64\v<version>\InstallUtil.exe</code>.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NET\Framework64\v<version>\InstallUtil.exe</code>. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: ComponentModel.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ComponentModel. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: RunInstaller(true)]</code>.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RunInstaller(true)]</code>. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Installutil)

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Installutil) ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing can be targeted, known as spearphishing.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing can be targeted, known as spearphishing. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input:
Sophos Attachment)(Citation: GitHub Phishery) Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing)

Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sophos Attachment)(Citation: GitHub Phishery) Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing)

Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input:
Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Palo Alto Unit 42 VBA Infostealer 2014)

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Palo Alto Unit 42 VBA Infostealer 2014) ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin)

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023)

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also link to "web bugs" or "web beacons" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address.(Citation: NIST Web Bug)

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also link to "web bugs" or "web beacons" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address.(Citation: NIST Web Bug) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also be able to spoof a complete website using what is known as a "browser-in-the-browser" (BitB) attack.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also be able to spoof a complete website using what is known as a "browser-in-the-browser" (BitB) attack. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods.(Citation: ZScaler BitB 2020)(Citation:

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods.(Citation: ZScaler BitB 2020)(Citation: ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Mr. D0x BitB 2022)

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mr. D0x BitB 2022) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to proxy the connection between the victim and the legitimate website.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to proxy the connection between the victim and the legitimate website. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539))

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: in addition to their username and password.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: in addition to their username and password. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input:
This may enable the adversary to then bypass MFA via [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004).(Citation: Proofpoint Human Factor)

From the fake website, information is gathered in web forms and sent to the adversary.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may enable the adversary to then bypass MFA via [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004).(Citation: Proofpoint Human Factor)

From the fake website, information is gathered in web forms and sent to the adversary. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary may then perform actions as the logged-on user.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary may then perform actions as the logged-on user. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: In an enterprise environment, servers and workstations can be organized into domains.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In an enterprise environment, servers and workstations can be organized into domains. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Management MDM macOS)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Management MDM macOS)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Kickstart Apple Remote Desktop commands)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kickstart Apple Remote Desktop commands)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Apple Remote Desktop Admin Guide 3.3)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple Remote Desktop Admin Guide 3.3) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Lockboxx ARD 2019)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Lockboxx ARD 2019)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Kickstart Apple Remote Desktop commands)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kickstart Apple Remote Desktop commands) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH).

Output: T1021.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). ### Response: T1021.004.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary may then perform actions as the logged-on user.

Output: T1021.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary may then perform actions as the logged-on user. ### Response: T1021.004.


Instruction: List the MITRE techniques contained in the text.

Input: SSH is a protocol that allows authorized users to open remote shells on other computers.

Output: T1021.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SSH is a protocol that allows authorized users to open remote shells on other computers. ### Response: T1021.004.


Instruction: List the MITRE techniques contained in the text.

Input: Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it.

Output: T1021.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. ### Response: T1021.004.


Instruction: List the MITRE techniques contained in the text.

Input: The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password.

Output: T1021.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. ### Response: T1021.004.


Instruction: List the MITRE techniques contained in the text.

Input: In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.

Output: T1021.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user. ### Response: T1021.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1098

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1098.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant.

Output: T1098.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. ### Response: T1098.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation:

Output: T1098.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: ### Response: T1098.003.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Support O365 Add Another Admin, October 2019)(Citation:

Output: T1098.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Support O365 Add Another Admin, October 2019)(Citation: ### Response: T1098.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)
(Citation: Microsoft O365 Admin Roles)

Output: T1098.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)
(Citation: Microsoft O365 Admin Roles) ### Response: T1098.003.


Instruction: List the MITRE techniques contained in the text.

Input: This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity.

Output: T1098.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. ### Response: T1098.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised.

Output: T1098.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. ### Response: T1098.003.


Instruction: List the MITRE techniques contained in the text.

Input: This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.

Output: T1098.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts. ### Response: T1098.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)

Output: T1098.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation) ### Response: T1098.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation:

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may achieve the same goal by modifying or extending features of the kernel.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may achieve the same goal by modifying or extending features of the kernel. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors) ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Registry key that points to the DLL.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry key that points to the DLL. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation:

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft AddPrintProcessor May 2018)

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft AddPrintProcessor May 2018) ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020) ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may disable security tools to avoid possible detection of their tools and activities.

Output: T1089

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may disable security tools to avoid possible detection of their tools and activities. ### Response: T1089.


Instruction: List the MITRE techniques contained in the text.

Input: This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.

Output: T1089

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting. ### Response: T1089.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may corrupt or wipe the disk data structures on hard drive necessary to boot systems; targeting specific critical systems as well as a large number of systems in a network to interrupt availability to system and network resources.

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may corrupt or wipe the disk data structures on hard drive necessary to boot systems; targeting specific critical systems as well as a large number of systems in a network to interrupt availability to system and network resources. ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation:

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky StoneDrill 2017)(Citation:

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky StoneDrill 2017)(Citation: ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: Unit 42 Shamoon3 2018)

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit 42 Shamoon3 2018) ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk.

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable.

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) if all sectors of a disk are wiped.

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) if all sectors of a disk are wiped. ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078),

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)

Output: T1487

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) ### Response: T1487.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send phishing messages to gain access to victim systems.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send phishing messages to gain access to victim systems. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing can be targeted, known as spearphishing.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing can be targeted, known as spearphishing. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing may also be conducted via third-party services, like social media platforms.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing may also be conducted via third-party services, like social media platforms. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Palo Alto Unit 42 VBA Infostealer 2014)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Palo Alto Unit 42 VBA Infostealer 2014) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Unit42 Luna Moth)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit42 Luna Moth) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. ### Response: T1566.001.