Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify plist files to automatically run an application when a user logs in.

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify plist files to automatically run an application when a user logs in. ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.(Citation: Methods of Mac Malware Persistence)(Citation:

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.(Citation: Methods of Mac Malware Persistence)(Citation: ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: Wardle Persistence Chapter)

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wardle Persistence Chapter) ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: Applications listed in this file are automatically reopened upon the user’s next logon.

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Applications listed in this file are automatically reopened upon the user’s next logon. ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the com.apple.loginwindow.[UUID].plist file to execute payloads when a user logs in.

Output: T1547.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the com.apple.loginwindow.[UUID].plist file to execute payloads when a user logs in. ### Response: T1547.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.

Output: T1547.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. ### Response: T1547.004.


Instruction: List the MITRE techniques contained in the text.

Input: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Output: T1547.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. ### Response: T1547.004.


Instruction: List the MITRE techniques contained in the text.

Input: Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation:

Output: T1547.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: ### Response: T1547.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Cylance Reg Persistence Sept 2013)

Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.

Output: T1547.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cylance Reg Persistence Sept 2013)

Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. ### Response: T1547.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)

* Winlogon\Notify - points to notification package DLLs that handle Winlogon events
* Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
* Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on

Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.

Output: T1547.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)

* Winlogon\Notify - points to notification package DLLs that handle Winlogon events
* Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
* Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on

Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence. ### Response: T1547.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots.

Output: T1547.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. ### Response: T1547.005.


Instruction: List the MITRE techniques contained in the text.

Input: Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start.

Output: T1547.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. ### Response: T1547.005.


Instruction: List the MITRE techniques contained in the text.

Input: Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

Output: T1547.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. ### Response: T1547.005.


Instruction: List the MITRE techniques contained in the text.

Input: The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages.

Output: T1547.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. ### Response: T1547.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)

Output: T1547.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014) ### Response: T1547.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key)

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: These programs will be executed under the context of the user and will have the account's associated permissions level.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These programs will be executed under the context of the user and will have the account's associated permissions level. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input:
The following run keys are created by default on Windows systems:

* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Run keys may exist under multiple hives.(Citation:

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following run keys are created by default on Windows systems:

* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Run keys may exist under multiple hives.(Citation: ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016)

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key)

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx:

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: <code>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: <code>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: 1 /d "C:\temp\evil[.]dll"</code> (Citation: Oddvar Moe RunOnceEx Mar 2018)

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 1 /d "C:\temp\evil[.]dll"</code> (Citation: Oddvar Moe RunOnceEx Mar 2018) ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: Placing a program within a startup folder will also cause that program to execute when a user logs in.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Placing a program within a startup folder will also cause that program to execute when a user logs in. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: The startup folder path for the current user is C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The startup folder path for the current user is C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input:
The following Registry keys can be used to set startup folder items for persistence:

* <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following Registry keys can be used to set startup folder items for persistence:

* <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Shell Folders
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

The following Registry keys can control automatic startup of services during boot:

* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Shell Folders
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

The following Registry keys can control automatic startup of services during boot:

* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: NT\CurrentVersion\Windows</code> run automatically for the currently logged-on user.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NT\CurrentVersion\Windows</code> run automatically for the currently logged-on user. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can add other programs or processes to this registry value which will automatically launch at boot.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can add other programs or processes to this registry value which will automatically launch at boot. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.

Output: T1547.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs. ### Response: T1547.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem)

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target LSASS drivers to obtain persistence.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target LSASS drivers to obtain persistence. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors) ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Registry key that points to the DLL.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry key that points to the DLL. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation:

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft AddPrintProcessor May 2018)

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft AddPrintProcessor May 2018) ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020) ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.

Output: T1547.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges. ### Response: T1547.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Active Setup is a Windows mechanism that is used to execute programs when a user logs in.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Active Setup is a Windows mechanism that is used to execute programs when a user logs in. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010)

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: These programs will be executed under the context of the user and will have the account's associated permissions level.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These programs will be executed under the context of the user and will have the account's associated permissions level. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Active Setup by creating a key under  HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Active Setup by creating a key under  HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation:

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye CFR Watering Hole 2012)(Citation:

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye CFR Watering Hole 2012)(Citation: ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016)

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.

Output: T1547.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs. ### Response: T1547.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges.

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled. ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013)

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications. ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup)

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation:

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Add List Remove Login Items Apple Script)

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Add List Remove Login Items Apple Script) ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: This command adds the path of the malicious executable to the login item file list located in <code>~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm</code>.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation:

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This command adds the path of the malicious executable to the login item file list located in <code>~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm</code>.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: CheckPoint Dok)(Citation: objsee netwire backdoor 2019)

Output: T1547.015

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CheckPoint Dok)(Citation: objsee netwire backdoor 2019) ### Response: T1547.015.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login.

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: XDG Autostart entries are available for any XDG-compliant Linux system.

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: XDG Autostart entries are available for any XDG-compliant Linux system. ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login.

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation:

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: Free Desktop Entry Keys)

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Free Desktop Entry Keys) ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse this feature to establish persistence by adding a path to a malicious binary or command to the `Exec` directive in the `.desktop` configuration file.

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse this feature to establish persistence by adding a path to a malicious binary or command to the `Exec` directive in the `.desktop` configuration file. ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: When the user’s desktop environment is loaded at user login, the `.desktop` files located in the XDG Autostart directories are automatically executed.

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the user’s desktop environment is loaded at user login, the `.desktop` files located in the XDG Autostart directories are automatically executed. ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: System-wide Autostart entries are located in the `/etc/xdg/autostart` directory while the user entries are located in the `~/.config/autostart` directory.

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: System-wide Autostart entries are located in the `/etc/xdg/autostart` directory while the user entries are located in the `~/.config/autostart` directory. ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may combine this technique with [Masquerading](https://attack.mitre.org/techniques/T1036) to blend malicious Autostart entries with legitimate programs.(Citation: Red Canary Netwire Linux 2022)

Output: T1547.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may combine this technique with [Masquerading](https://attack.mitre.org/techniques/T1036) to blend malicious Autostart entries with legitimate programs.(Citation: Red Canary Netwire Linux 2022) ### Response: T1547.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse time providers to execute DLLs when the system boots.

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse time providers to execute DLLs when the system boots. ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation:

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft W32Time Feb 2018)

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft W32Time Feb 2018) ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input:
W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)

Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\.(Citation:

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)

Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\.(Citation: ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft TimeProvider)

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft TimeProvider) ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input: The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider)

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider) ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider.

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider. ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input: Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation:

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input: Github W32Time Oct 2017)

Output: T1547.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Github W32Time Oct 2017) ### Response: T1547.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse authentication packages to execute DLLs when the system boots.

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse authentication packages to execute DLLs when the system boots. ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start.

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages)

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ with the key value of "Authentication Packages"=<target binary>.

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ with the key value of "Authentication Packages"=<target binary>. ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: The binary will then be executed by the system when the authentication packages are loaded.

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The binary will then be executed by the system when the authentication packages are loaded. ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Input: A port monitor can be set through the AddMonitor

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A port monitor can be set through the AddMonitor ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Input: API call to set a DLL to be loaded at startup.(Citation: AddMonitor)

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: API call to set a DLL to be loaded at startup.(Citation: AddMonitor) ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Input: This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot.

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Input: The spoolsv.exe process also runs under SYSTEM level permissions.(Citation: Bloxham)

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The spoolsv.exe process also runs under SYSTEM level permissions.(Citation: Bloxham) ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Input: The Registry key contains entries for the following:

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Registry key contains entries for the following: ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Input:
Local Port
* Standard TCP/IP Port
* USB Monitor
* WSD Port

Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.

Output: T1547.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Local Port
* Standard TCP/IP Port
* USB Monitor
* WSD Port

Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM. ### Response: T1547.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation:

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may achieve the same goal by modifying or extending features of the kernel.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may achieve the same goal by modifying or extending features of the kernel. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Additional custom tools likely exist as well.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional custom tools likely exist as well. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation:

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets.

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry.

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)

Output: T1003.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets) ### Response: T1003.004.


Instruction: List the MITRE techniques contained in the text.

Input: A port monitor can be set through the  (Citation: AddMonitor)

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A port monitor can be set through the  (Citation: AddMonitor) ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input: API call to set a DLL to be loaded at startup.

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: API call to set a DLL to be loaded at startup. ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AddMonitor)

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AddMonitor) ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input: This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot.

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input: The spoolsv.exe process also runs under SYSTEM level permissions.

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The spoolsv.exe process also runs under SYSTEM level permissions. ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Bloxham)

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Bloxham) ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input: The Registry key contains entries for the following:

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Registry key contains entries for the following: ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input:
Local Port
* Standard TCP/IP Port
* USB Monitor
* WSD Port

Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.

Output: T1013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Local Port
* Standard TCP/IP Port
* USB Monitor
* WSD Port

Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM. ### Response: T1013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution)

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes).

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key.

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key. ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device.

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Cisco Blog Legacy Device Attacks)

Output: T1600.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Blog Legacy Device Attacks) ### Response: T1600.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.

Output: T1600.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. ### Response: T1600.002.


Instruction: List the MITRE techniques contained in the text.

Input: Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks.

Output: T1600.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. ### Response: T1600.002.


Instruction: List the MITRE techniques contained in the text.

Input: Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering.

Output: T1600.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. ### Response: T1600.002.


Instruction: List the MITRE techniques contained in the text.

Input: When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors.

Output: T1600.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. ### Response: T1600.002.


Instruction: List the MITRE techniques contained in the text.

Input: This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)).

Output: T1600.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). ### Response: T1600.002.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Cisco Blog Legacy Device Attacks)

Output: T1600.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Blog Legacy Device Attacks) ### Response: T1600.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Cisco Synful Knock Evolution)

Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes).

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Synful Knock Evolution)

Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can compromise and manipulate devices that perform encryption of network traffic.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can compromise and manipulate devices that perform encryption of network traffic. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts. ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Cisco Blog Legacy Device Attacks)

Output: T1600

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Blog Legacy Device Attacks) ### Response: T1600.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may generate these credential materials in order to gain access to web resources.

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may generate these credential materials in order to gain access to web resources. ### Response: T1606.