Instruction: List the MITRE techniques contained in the text.

Input: For example, on Windows names and passwords of all Wi-Fi networks a device has previously connected to may be available through `netsh wlan show profiles` to enumerate Wi-Fi names and then `netsh wlan show profile “Wi-Fi name” key=clear` to show a Wi-Fi network’s corresponding password.(Citation: BleepingComputer Agent Tesla steal wifi passwords)(Citation:

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on Windows names and passwords of all Wi-Fi networks a device has previously connected to may be available through `netsh wlan show profiles` to enumerate Wi-Fi names and then `netsh wlan show profile “Wi-Fi name” key=clear` to show a Wi-Fi network’s corresponding password.(Citation: BleepingComputer Agent Tesla steal wifi passwords)(Citation: ### Response: T1016.002.


Instruction: List the MITRE techniques contained in the text.

Input: Malware Bytes New AgentTesla variant steals WiFi credentials)(Citation: Check Point APT35 CharmPower January 2022)

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware Bytes New AgentTesla variant steals WiFi credentials)(Citation: Check Point APT35 CharmPower January 2022) ### Response: T1016.002.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, names and other details of locally reachable Wi-Fi networks can be discovered using calls to `wlanAPI.dll` [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: Binary Defense Emotes Wi-Fi Spreader)

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, names and other details of locally reachable Wi-Fi networks can be discovered using calls to `wlanAPI.dll` [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: Binary Defense Emotes Wi-Fi Spreader) ### Response: T1016.002.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux, names and passwords of all Wi-Fi-networks a device has previously connected to may be available in files under ` /etc/NetworkManager/system-connections/`.(Citation: Wi-Fi Password of All Connected Networks in Windows/Linux)

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux, names and passwords of all Wi-Fi-networks a device has previously connected to may be available in files under ` /etc/NetworkManager/system-connections/`.(Citation: Wi-Fi Password of All Connected Networks in Windows/Linux) ### Response: T1016.002.


Instruction: List the MITRE techniques contained in the text.

Input: On macOS, the password of a known Wi-Fi may be identified with ` security find-generic-password -wa wifiname` (requires admin username/password).(Citation: Find Wi-Fi Password on Mac)

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On macOS, the password of a known Wi-Fi may be identified with ` security find-generic-password -wa wifiname` (requires admin username/password).(Citation: Find Wi-Fi Password on Mac) ### Response: T1016.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may check for Internet connectivity on compromised systems.

Output: T1016.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may check for Internet connectivity on compromised systems. ### Response: T1016.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites.

Output: T1016.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites. ### Response: T1016.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them.

Output: T1016.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. ### Response: T1016.001.


Instruction: List the MITRE techniques contained in the text.

Input: The results may also be used to identify routes, redirectors, and proxy servers.

Output: T1016.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The results may also be used to identify routes, redirectors, and proxy servers. ### Response: T1016.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

Output: T1016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. ### Response: T1016.


Instruction: List the MITRE techniques contained in the text.

Input: Several operating system administration utilities exist that can be used to gather this information.

Output: T1016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several operating system administration utilities exist that can be used to gather this information. ### Response: T1016.


Instruction: List the MITRE techniques contained in the text.

Input: Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).

Output: T1016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103). ### Response: T1016.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface).(Citation:

Output: T1016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface).(Citation: ### Response: T1016.


Instruction: List the MITRE techniques contained in the text.

Input: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion )

Output: T1016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion ) ### Response: T1016.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

Output: T1016

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. ### Response: T1016.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses.

Output: T1578

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. ### Response: T1578.


Instruction: List the MITRE techniques contained in the text.

Input: A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.

Output: T1578

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. ### Response: T1578.


Instruction: List the MITRE techniques contained in the text.

Input: Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure.

Output: T1578

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. ### Response: T1578.


Instruction: List the MITRE techniques contained in the text.

Input: Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)

Output: T1578

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020) ### Response: T1578.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.

Output: T1578.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. ### Response: T1578.003.


Instruction: List the MITRE techniques contained in the text.

Input: Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.

Output: T1578.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. ### Response: T1578.003.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation:

Output: T1578.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: ### Response: T1578.003.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant M-Trends 2020)

Output: T1578.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant M-Trends 2020) ### Response: T1578.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting.

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation:

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: SecurityTrails Google Hacking)(Citation:

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SecurityTrails Google Hacking)(Citation: ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: ExploitDB

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ExploitDB ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: GoogleHacking)

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GoogleHacking) ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search in different online sites depending on what information they seek to gather.

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search in different online sites depending on what information they seek to gather. ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)). ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search public code repositories for information about victims that can be used during targeting.

Output: T1593.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search public code repositories for information about victims that can be used during targeting. ### Response: T1593.003.


Instruction: List the MITRE techniques contained in the text.

Input: Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket.

Output: T1593.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. ### Response: T1593.003.


Instruction: List the MITRE techniques contained in the text.

Input: Users typically interact with code repositories through a web application or command-line utilities such as git.

Output: T1593.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users typically interact with code repositories through a web application or command-line utilities such as git. ### Response: T1593.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search various public code repositories for various information about a victim.

Output: T1593.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search various public code repositories for various information about a victim. ### Response: T1593.003.


Instruction: List the MITRE techniques contained in the text.

Input: Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees.

Output: T1593.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. ### Response: T1593.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys.(Citation: GitHub Cloud Service Credentials) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).

Output: T1593.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys.(Citation: GitHub Cloud Service Credentials) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). ### Response: T1593.003.


Instruction: List the MITRE techniques contained in the text.

Input: **Note:**

Output: T1593.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **Note:** ### Response: T1593.003.


Instruction: List the MITRE techniques contained in the text.

Input: This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1213/003), which focuses on [Collection](https://attack.mitre.org/tactics/TA0009) from private and internally hosted code repositories.

Output: T1593.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1213/003), which focuses on [Collection](https://attack.mitre.org/tactics/TA0009) from private and internally hosted code repositories. ### Response: T1593.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: How the operating system locates libraries to be used by a program can also be intercepted.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: How the operating system locates libraries to be used by a program can also be intercepted. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: These processes may automatically execute specific binaries as part of their functionality or to perform other actions.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These processes may automatically execute specific binaries as part of their functionality or to perform other actions. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: During the installation process, it is common for installers to use a subdirectory within the <code>%TEMP%</code> directory to unpack binaries such as DLLs, EXEs, or other payloads.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the installation process, it is common for installers to use a subdirectory within the <code>%TEMP%</code> directory to unpack binaries such as DLLs, EXEs, or other payloads. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001). ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002).

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012)

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.

Output: T1574.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence. ### Response: T1574.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft DART Case Report 001)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft DART Case Report 001) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Malware Persistence on OS X)(Citation: amnesia malware)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware Persistence on OS X)(Citation: amnesia malware) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen).

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Hikit Rootkit)

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Hikit Rootkit) ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the version of Windows, an adversary may take advantage of these features in different ways.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the version of Windows, an adversary may take advantage of these features in different ways. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in <code>%systemdir%\</code>, and it must be protected by Windows File or Resource Protection (WFP/WRP).

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in <code>%systemdir%\</code>, and it must be protected by Windows File or Resource Protection (WFP/WRP). ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: DEFCON2016 Sticky Keys)

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: DEFCON2016 Sticky Keys) ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access).

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Tilbury 2014)

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Tilbury 2014) ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)

*

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)

* ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
On-Screen Keyboard: C:\Windows\System32\osk.exe
*

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On-Screen Keyboard: C:\Windows\System32\osk.exe
* ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
Magnifier: C:\Windows\System32\Magnify.exe
*

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Magnifier: C:\Windows\System32\Magnify.exe
* ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
Narrator: C:\Windows\System32\Narrator.exe
*

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Narrator: C:\Windows\System32\Narrator.exe
* ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gain persistence and elevate privileges in certain situations by abusing [PowerShell](https://attack.mitre.org/techniques/T1086) profiles.

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gain persistence and elevate privileges in certain situations by abusing [PowerShell](https://attack.mitre.org/techniques/T1086) profiles. ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: A PowerShell profile  (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments.

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A PowerShell profile  (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: PowerShell supports several profiles depending on the user or host program.

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PowerShell supports several profiles depending on the user or host program. ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code.

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: An administrator can also configure a profile that applies to all users and host programs on the local computer.

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An administrator can also configure a profile that applies to all users and host programs on the local computer. ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft About Profiles)

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft About Profiles) ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or PowerShell drives to gain persistence.

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or PowerShell drives to gain persistence. ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: Every time a user opens a PowerShell session the modified script will be executed unless the <code>-NoProfile</code> flag is used when it is launched.

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Every time a user opens a PowerShell session the modified script will be executed unless the <code>-NoProfile</code> flag is used when it is launched. ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: ESET Turla PowerShell May 2019)

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: ESET Turla PowerShell May 2019) ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator.

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wits End and Shady PowerShell Profiles)

Output: T1504

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wits End and Shady PowerShell Profiles) ### Response: T1504.


Instruction: List the MITRE techniques contained in the text.

Input: In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe).

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,  (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,  (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: SpectorOps Subverting Trust Sept 2017)

Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SpectorOps Subverting Trust Sept 2017)

Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all  (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs).

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all  (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: SpectorOps Subverting Trust Sept 2017)

Similar to [Code Signing](https://attack.mitre.org/techniques/T1116), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SpectorOps Subverting Trust Sept 2017)

Similar to [Code Signing](https://attack.mitre.org/techniques/T1116), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may hijack SIP and trust provider components to mislead operating system and whitelisting tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may hijack SIP and trust provider components to mislead operating system and whitelisting tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017) ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: * Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE[\WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE[\WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file). ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function).

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Output: T1198


Instruction: List the MITRE techniques contained in the text.

Input: Modifying the DLL and Function

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifying the DLL and Function ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: Registry values in HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\Providers\Trust\FinalPolicy\{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry values in HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\Providers\Trust\FinalPolicy\{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex). ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: * **Note:**

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * **Note:** ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: The above hijacks are also possible without modifying the Registry via [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The above hijacks are also possible without modifying the Registry via [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038). ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation.

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: SpectorOps Subverting Trust Sept 2017)

Output: T1198

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SpectorOps Subverting Trust Sept 2017) ### Response: T1198.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of email addresses and accounts.

Output: T1087.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of email addresses and accounts. ### Response: T1087.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)

Output: T1087.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) ### Response: T1087.003.


Instruction: List the MITRE techniques contained in the text.

Input: In on-premises Exchange and Exchange Online, theGet-GlobalAddressList

Output: T1087.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In on-premises Exchange and Exchange Online, theGet-GlobalAddressList ### Response: T1087.003.


Instruction: List the MITRE techniques contained in the text.

Input: PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation:

Output: T1087.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: ### Response: T1087.003.


Instruction: List the MITRE techniques contained in the text.

Input: Black Hills Attacking Exchange MailSniper, 2016)

Output: T1087.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Black Hills Attacking Exchange MailSniper, 2016) ### Response: T1087.003.


Instruction: List the MITRE techniques contained in the text.

Input: In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service.

Output: T1087.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. ### Response: T1087.003.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)

Output: T1087.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List) ### Response: T1087.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of cloud accounts.

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of cloud accounts. ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: With authenticated access there are several tools that can be used to find accounts.

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With authenticated access there are several tools that can be used to find accounts. ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation:

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft msolrolemember)(Citation: GitHub Raindance)

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft msolrolemember)(Citation: GitHub Raindance) ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain.

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation:

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: Black Hills Red Teaming MS AD Azure, 2018)

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Black Hills Red Teaming MS AD Azure, 2018) ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)

Output: T1087.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API) ### Response: T1087.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of domain accounts.

Output: T1087.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of domain accounts. ### Response: T1087.002.


Instruction: List the MITRE techniques contained in the text.

Input:
This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.

Output: T1087.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. ### Response: T1087.002.


Instruction: List the MITRE techniques contained in the text.

Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.

Output: T1087.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups. ### Response: T1087.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of local system accounts.

Output: T1087.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of local system accounts. ### Response: T1087.001.


Instruction: List the MITRE techniques contained in the text.

Input: This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Output: T1087.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. ### Response: T1087.001.


Instruction: List the MITRE techniques contained in the text.

Input: Commands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groupson macOS and Linux can list local users and groups.

Output: T1087.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groupson macOS and Linux can list local users and groups. ### Response: T1087.001.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file.

Output: T1087.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. ### Response: T1087.001.


Instruction: List the MITRE techniques contained in the text.

Input: On macOS the <code>dscl .

Output: T1087.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On macOS the <code>dscl . ### Response: T1087.001.


Instruction: List the MITRE techniques contained in the text.

Input: list /Users</code> command can be used to enumerate local accounts.

Output: T1087.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: list /Users</code> command can be used to enumerate local accounts. ### Response: T1087.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: Information about email addresses and accounts may also be extracted by searching an infected system’s files.

Output: T1087

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about email addresses and accounts may also be extracted by searching an infected system’s files. ### Response: T1087.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

Output: T1090.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. ### Response: T1090.001.


Instruction: List the MITRE techniques contained in the text.

Input: Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.

Output: T1090.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. ### Response: T1090.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Trend Micro APT Attack Tools)

Output: T1090.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Trend Micro APT Attack Tools) ### Response: T1090.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion.

Output: T1090.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. ### Response: T1090.001.