Instruction: List the MITRE techniques contained in the text.

Input: Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques)

Output: T1070.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques) ### Response: T1070.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify mail and mail application data to remove evidence of their activity.

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify mail and mail application data to remove evidence of their activity. ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs.

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of [Phishing](https://attack.mitre.org/techniques/T1566)/[Internal Spearphishing](https://attack.mitre.org/techniques/T1534),

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of [Phishing](https://attack.mitre.org/techniques/T1566)/[Internal Spearphishing](https://attack.mitre.org/techniques/T1534), ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: [Email Collection](https://attack.mitre.org/techniques/T1114), [Mail Protocols](https://attack.mitre.org/techniques/T1071/003) for command and control, or email-based exfiltration such as [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Email Collection](https://attack.mitre.org/techniques/T1114), [Mail Protocols](https://attack.mitre.org/techniques/T1071/003) for command and control, or email-based exfiltration such as [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.(Citation: Volexity SolarWinds)(Citation:

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [PowerShell](https://attack.mitre.org/techniques/T1059/001) module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.(Citation: Volexity SolarWinds)(Citation: ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: ExchangePowerShell Module)

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ExchangePowerShell Module) ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux and macOS, adversaries may also delete emails through a command line utility called mail  or use [AppleScript](https://attack.mitre.org/techniques/T1059/002) to interact with APIs on macOS.(Citation:

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux and macOS, adversaries may also delete emails through a command line utility called mail  or use [AppleScript](https://attack.mitre.org/techniques/T1059/002) to interact with APIs on macOS.(Citation: ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: Cybereason Cobalt Kitty 2017)(Citation: mailx man page)

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cybereason Cobalt Kitty 2017)(Citation: mailx man page) ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.(Citation:

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.(Citation: ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft OAuth Spam 2022)

Output: T1070.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft OAuth Spam 2022) ### Response: T1070.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear system logs to hide evidence of an intrusion.

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear system logs to hide evidence of an intrusion. ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input: macOS and Linux both keep track of system or user-initiated actions via system logs.

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: macOS and Linux both keep track of system or user-initiated actions via system logs. ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input: The majority of native system logging is stored under the <code>/var/log/</code> directory.

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The majority of native system logging is stored under the <code>/var/log/</code> directory. ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

* <code>/var/log/messages:</code>:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

* <code>/var/log/messages:</code>: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
General and system-related messages
* /var/log/secure or /var/log/auth.log:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: General and system-related messages
* /var/log/secure or /var/log/auth.log: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Authentication logs
* /var/log/utmp or /var/log/wtmp:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Authentication logs
* /var/log/utmp or /var/log/wtmp: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Login records
* <code>/var/log/kern.log</code>:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login records
* <code>/var/log/kern.log</code>: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Kernel logs
*

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kernel logs
* ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input: <code>/var/log/cron.log</code>:

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: <code>/var/log/cron.log</code>: ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Crond logs
* /var/log/maillog: Mail server logs
* /var/log/httpd/: Web server access and error logs

Output: T1070.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Crond logs
* /var/log/maillog: Mail server logs
* /var/log/httpd/: Web server access and error logs ### Response: T1070.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

Output: T1070.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear Windows Event Logs to hide the activity of an intrusion. ### Response: T1070.001.


Instruction: List the MITRE techniques contained in the text.

Input: Windows Event Logs are a record of a computer's alerts and notifications.

Output: T1070.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows Event Logs are a record of a computer's alerts and notifications. ### Response: T1070.001.


Instruction: List the MITRE techniques contained in the text.

Input: There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

Output: T1070.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. ### Response: T1070.001.


Instruction: List the MITRE techniques contained in the text.

Input:
The event logs can be cleared with the following utility commands:

* wevtutil cl system
* wevtutil cl application
* wevtutil cl security

These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001).

Output: T1070.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The event logs can be cleared with the following utility commands:

* wevtutil cl system
* wevtutil cl application
* wevtutil cl security

These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). ### Response: T1070.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging.

Output: T1070.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. ### Response: T1070.001.


Instruction: List the MITRE techniques contained in the text.

Input: Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)

Output: T1070.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) ### Response: T1070.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112),

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm)

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation:

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: Talos - Cisco Attack 2022)

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos - Cisco Attack 2022) ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation:

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: NCC Group Team9 June 2020)

Output: T1070.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NCC Group Team9 June 2020) ### Response: T1070.009.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux and macOS, these command histories can be accessed in a few different ways.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux and macOS, these command histories can be accessed in a few different ways. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: The benefit of this is that it allows users to go back to commands they've used before in different sessions.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The benefit of this is that it allows users to go back to commands they've used before in different sessions. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to clear command history data (clear logging and/or clear history).(Citation: US-CERT-TA18-106A)

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to clear command history data (clear logging and/or clear history).(Citation: US-CERT-TA18-106A) ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: The built-in history only tracks the commands used in the current session.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The built-in history only tracks the commands used in the current session. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: This command history is not available to other sessions and is deleted when the session ends.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This command history is not available to other sessions and is deleted when the session ends. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History) ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: This, however, will not delete/flush the ConsoleHost_history.txt file.

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This, however, will not delete/flush the ConsoleHost_history.txt file. ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)

Output: T1070.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics) ### Response: T1070.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133).

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries. ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Network connection history may be stored in various locations.

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network connection history may be stored in various locations. ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input:
For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):

* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers

Windows may also store information about recent RDP connections in files such as C:\Users\\%username%\Documents\Default.rdp and `C:\Users\%username%\AppData\Local\Microsoft\Terminal
Server Client\Cache\`.(Citation:

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):

* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers

Windows may also store information about recent RDP connections in files such as C:\Users\\%username%\Documents\Default.rdp and `C:\Users\%username%\AppData\Local\Microsoft\Terminal
Server Client\Cache\`.(Citation: ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Moran RDPieces)

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Moran RDPieces) ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input:
Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)

Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090).

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)

Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.

Output: T1070.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis. ### Response: T1070.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

Output: T1070.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. ### Response: T1070.005.


Instruction: List the MITRE techniques contained in the text.

Input: Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed.

Output: T1070.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. ### Response: T1070.005.


Instruction: List the MITRE techniques contained in the text.

Input: [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.

Output: T1070.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. ### Response: T1070.005.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Technet Net Use)

Output: T1070.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Technet Net Use) ### Response: T1070.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This may compromise the integrity of security solutions by causing notable events to go unreported.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may compromise the integrity of security solutions by causing notable events to go unreported. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: The data may also be sent to an alternate network location from the main command and control server.

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The data may also be sent to an alternate network location from the main command and control server. ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel.

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also opt to encrypt and/or obfuscate these alternate channels.

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also opt to encrypt and/or obfuscate these alternate channels. ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016)

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input:
On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)

Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).

Output: T1048

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)

Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009). ### Response: T1048.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

Output: T1048.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. ### Response: T1048.001.


Instruction: List the MITRE techniques contained in the text.

Input: The data may also be sent to an alternate network location from the main command and control server.

Output: T1048.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The data may also be sent to an alternate network location from the main command and control server. ### Response: T1048.001.


Instruction: List the MITRE techniques contained in the text.

Input: Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel.

Output: T1048.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. ### Response: T1048.001.


Instruction: List the MITRE techniques contained in the text.

Input: This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data.

Output: T1048.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. ### Response: T1048.001.


Instruction: List the MITRE techniques contained in the text.

Input: Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES)

Output: T1048.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) ### Response: T1048.001.


Instruction: List the MITRE techniques contained in the text.

Input: vice using mechanisms that are baked into a protocol.

Output: T1048.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: vice using mechanisms that are baked into a protocol. ### Response: T1048.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).

Output: T1048.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP). ### Response: T1048.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: SensePost Ruler GitHub)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SensePost Ruler GitHub) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet O365 Outlook Rules)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet O365 Outlook Rules) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Office contains templates that are part of common Office applications and are used to customize styles.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Office contains templates that are part of common Office applications and are used to customize styles. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: The base templates within the application are used each time an application starts.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The base templates within the application are used each time an application starts. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Change Normal Template)

Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Change Normal Template)

Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Examples for both Word and Excel have been discovered and published.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples for both Word and Excel have been discovered and published. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: By default, Word has a Normal.dotm template created that can be modified to include a malicious macro.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation:

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019)

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Word Normal.dotm

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Word Normal.dotm ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input:
location:

C:\Users\<username>\AppData\Roaming\Microsoft\Templates\Normal.dotm

Excel Personal.xlsb

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: location:

C:\Users\<username>\AppData\Roaming\Microsoft\Templates\Normal.dotm

Excel Personal.xlsb ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input:
location:

C:\Users\<username>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB

Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\Program Files (x86)\Microsoft Office\root\Office16\, or by modifying the GlobalDotName registry key.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: location:

C:\Users\<username>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB

Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\Program Files (x86)\Microsoft Office\root\Office16\, or by modifying the GlobalDotName registry key. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019)

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.

Output: T1137.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros. ### Response: T1137.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation:

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT29 Microsoft 365 2022)

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT29 Microsoft 365 2022) ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting.

Output: T1583.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. ### Response: T1583.003.


Instruction: List the MITRE techniques contained in the text.

Input: There exist a variety of cloud service providers that will sell virtual machines/containers as a service.

Output: T1583.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There exist a variety of cloud service providers that will sell virtual machines/containers as a service. ### Response: T1583.003.


Instruction: List the MITRE techniques contained in the text.

Input: By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them.

Output: T1583.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. ### Response: T1583.003.


Instruction: List the MITRE techniques contained in the text.

Input: The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.

Output: T1583.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. ### Response: T1583.003.


Instruction: List the MITRE techniques contained in the text.

Input: Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers.

Output: T1583.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. ### Response: T1583.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)

Output: T1583.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease) ### Response: T1583.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage information repositories to mine valuable information.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage information repositories to mine valuable information. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

*

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

* ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
Policies, procedures, and standards
* Physical / logical network diagrams
*

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Policies, procedures, and standards
* Physical / logical network diagrams
* ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
*

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input:
Source code snippets
* Links to network shares and other internal resources

Information stored in a repository may vary based on the specific instance or environment.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Source code snippets
* Links to network shares and other internal resources

Information stored in a repository may vary based on the specific instance or environment. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Specific common information repositories include web-based platforms such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) and [Confluence](https://attack.mitre.org/techniques/T1213/001), specific services such as Code Repositories, IaaS databases, enterprise databases, and other storage infrastructure such as SQL Server.

Output: T1213

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific common information repositories include web-based platforms such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) and [Confluence](https://attack.mitre.org/techniques/T1213/001), specific services such as Code Repositories, IaaS databases, enterprise databases, and other storage infrastructure such as SQL Server. ### Response: T1213.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage Confluence repositories to mine valuable information.

Output: T1213.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage Confluence repositories to mine valuable information. ### Response: T1213.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:

* Policies, procedures, and standards
* Physical / logical network diagrams
*

Output: T1213.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:

* Policies, procedures, and standards
* Physical / logical network diagrams
* ### Response: T1213.001.


Instruction: List the MITRE techniques contained in the text.

Input:
System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
*

Output: T1213.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* ### Response: T1213.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Source code snippets
* Links to network shares and other internal resources

Output: T1213.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Source code snippets
* Links to network shares and other internal resources ### Response: T1213.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input:
Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos authentication can be used as the first step to lateral movement to a remote system.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos authentication can be used as the first step to lateral movement to a remote system. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket)

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket) ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks)

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks) ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation:

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Campbell 2014)

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Campbell 2014) ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash)

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash) ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse a container administration service to execute commands within a container.

Output: T1609

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse a container administration service to execute commands within a container. ### Response: T1609.


Instruction: List the MITRE techniques contained in the text.

Input: A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)

Output: T1609

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet) ### Response: T1609.


Instruction: List the MITRE techniques contained in the text.

Input: In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.(Citation: Kubectl Exec Get Shell)

Output: T1609

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.(Citation: Kubectl Exec Get Shell) ### Response: T1609.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Output: T1083

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. ### Response: T1083.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Output: T1083

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. ### Response: T1083.


Instruction: List the MITRE techniques contained in the text.

Input: Many command shell utilities can be used to obtain this information.

Output: T1083

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many command shell utilities can be used to obtain this information. ### Response: T1083.