Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: File Execution Options\<executable> where <executable> is the binary on which the debugger is attached.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File Execution Options\<executable> where <executable> is the binary on which the debugger is attached. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Dev Blog IFEO Mar 2010)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Dev Blog IFEO Mar 2010) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process).

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)

Similar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for an accessibility program (ex: utilman.exe).

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)

Similar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for an accessibility program (ex: utilman.exe). ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the "debugger" program to be executed with SYSTEM privileges.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the "debugger" program to be executed with SYSTEM privileges. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Tilbury 2014)

Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Tilbury 2014)

Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Elastic Process Injection July 2017)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: Malware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by executing malicious content triggered by a file type association.

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by executing malicious content triggered by a file type association. ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: When a file is opened, the default program used to open the file (also called the file association or handler) is checked.

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a file is opened, the default program used to open the file (also called the file association or handler) is checked. ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.(Citation

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.(Citation ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: : Microsoft Change Default Programs)(Citation: Microsoft File Handlers)(Citation:

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: : Microsoft Change Default Programs)(Citation: Microsoft File Handlers)(Citation: ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened. ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: System file associations are listed under HKEY_CLASSES_ROOT\.[extension], for example HKEY_CLASSES_ROOT\.txt.

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: System file associations are listed under HKEY_CLASSES_ROOT\.[extension], for example HKEY_CLASSES_ROOT\.txt. ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\\[handler].

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\\[handler]. ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\\[handler]\shell\\[action]\command.

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\\[handler]\shell\\[action]\command. ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input:
For example:

* HKEY_CLASSES_ROOT\txtfile\shell\open\command
* HKEY_CLASSES_ROOT\txtfile\shell\print\command
* HKEY_CLASSES_ROOT\txtfile\shell\printto\command

The values of the keys listed are commands that are executed when the handler opens the file extension.

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example:

* HKEY_CLASSES_ROOT\txtfile\shell\open\command
* HKEY_CLASSES_ROOT\txtfile\shell\print\command
* HKEY_CLASSES_ROOT\txtfile\shell\printto\command

The values of the keys listed are commands that are executed when the handler opens the file extension. ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can modify these values to continually execute arbitrary commands.(Citation: TrendMicro TROJ-FAKEAV OCT 2012)

Output: T1546.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can modify these values to continually execute arbitrary commands.(Citation: TrendMicro TROJ-FAKEAV OCT 2012) ### Response: T1546.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

Output: T1546.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. ### Response: T1546.009.


Instruction: List the MITRE techniques contained in the text.

Input: Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs

Output: T1546.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs ### Response: T1546.009.


Instruction: List the MITRE techniques contained in the text.

Input: Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.

Output: T1546.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. ### Response: T1546.009.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Elastic Process Injection July 2017)

Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Output: T1546.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017)

Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. ### Response: T1546.009.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.

Output: T1546.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity. ### Response: T1546.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond).

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action.

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: The rule files are in the plist format and define the name, event type, and action to take.

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The rule files are in the plist format and define the name, event type, and action to take. ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: Some examples of event types include system startup and user authentication.

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some examples of event types include system startup and user authentication. ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of actions are to run a system command or send an email.

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of actions are to run a system command or send an email. ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation:

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.

Output: T1546.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service. ### Response: T1546.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen).

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Hikit Rootkit)

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Hikit Rootkit) ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the version of Windows, an adversary may take advantage of these features in different ways.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the version of Windows, an adversary may take advantage of these features in different ways. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in <code>%systemdir%\</code>, and it must be protected by Windows File or Resource Protection (WFP/WRP).

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in <code>%systemdir%\</code>, and it must be protected by Windows File or Resource Protection (WFP/WRP). ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: DEFCON2016 Sticky Keys)

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: DEFCON2016 Sticky Keys) ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access).

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges.

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges. ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Tilbury 2014)

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Tilbury 2014) ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)

*

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)

* ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
On-Screen Keyboard: C:\Windows\System32\osk.exe
*

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On-Screen Keyboard: C:\Windows\System32\osk.exe
* ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
Magnifier: C:\Windows\System32\Magnify.exe
*

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Magnifier: C:\Windows\System32\Magnify.exe
* ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
Narrator: C:\Windows\System32\Narrator.exe
*

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Narrator: C:\Windows\System32\Narrator.exe
* ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input:
Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe

Output: T1546.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe ### Response: T1546.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft DART Case Report 001)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft DART Case Report 001) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Malware Persistence on OS X)(Citation: amnesia malware)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware Persistence on OS X)(Citation: amnesia malware) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation:

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation:

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft DART Case Report 001)

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation:

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: Malware Persistence on OS X)(Citation: amnesia malware)

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Output: T1546


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: All login shells on a system use /etc/profile when initiated.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All login shells on a system use /etc/profile when initiated. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc)

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc) ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: These files typically require root permissions to modify and are executed each time any shell on a system launches.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These files typically require root permissions to modify and are executed each time any shell on a system launches. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation: Linux manual bash invocation)

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation: Linux manual bash invocation) ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Since the system only executes the first existing file in the listed order, adversaries have used <code>~/.bash_profile</code> to ensure execution.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the system only executes the first existing file in the listed order, adversaries have used <code>~/.bash_profile</code> to ensure execution. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation: Magento) Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation: Magento) Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation: code_persistence_zsh)(Citation: macOS MS office sandbox escape) The login shell then configures the user environment with ~/.zprofile and ~/.zlogin.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation: code_persistence_zsh)(Citation: macOS MS office sandbox escape) The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: The interactive shell uses the <code>~/.zshrc</code> to configure the user environment.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The interactive shell uses the <code>~/.zshrc</code> to configure the user environment. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Upon exiting, /etc/zlogout and ~/.zlogout are executed.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Upon exiting, /etc/zlogout and ~/.zlogout are executed. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: For legacy programs, macOS executes <code>/etc/bashrc</code> on startup.

Output: T1546.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For legacy programs, macOS executes <code>/etc/bashrc</code> on startup. ### Response: T1546.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia Server Message Block)

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia Server Message Block) ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Didier Stevens WebDAV Traffic) (Citation: Microsoft Managing WebDAV Security)

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Didier Stevens WebDAV Traffic) (Citation: Microsoft Managing WebDAV Security) ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s).

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: When the user's system accesses the untrusted resource it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary controlled server.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the user's system accesses the untrusted resource it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary controlled server. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Cylance Redirect to SMB)

There are several different ways this can occur.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cylance Redirect to SMB)

There are several different ways this can occur. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Osanda Stealing NetNTLM Hashes)

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Osanda Stealing NetNTLM Hashes) ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input:
Some specifics from in-the-wild use include:

*

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some specifics from in-the-wild use include:

* ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)).

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: US-CERT APT Energy Oct 2017)
*

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: US-CERT APT Energy Oct 2017)
* ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: A modified .LNK or .SCF file with the icon filename pointing to an external reference such as <code>\\[remote address]\pic.png</code> that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A modified .LNK or .SCF file with the icon filename pointing to an external reference such as <code>\\[remote address]\pic.png</code> that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: US-CERT APT Energy Oct 2017)

Output: T1187

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: US-CERT APT Energy Oct 2017) ### Response: T1187.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: Windows uses access tokens to determine the ownership of a running process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows uses access tokens to determine the ownership of a running process. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: When this occurs, the process also takes on the security context associated with the new token.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When this occurs, the process also takes on the security context associated with the new token. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)).

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary must already be in a privileged user context (i.e. administrator) to steal a token.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary must already be in a privileged user context (i.e. administrator) to steal a token. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input:
An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use SID-History Injection to escalate privileges and bypass access controls.

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows security identifier (SID) is a unique value that identifies a user or group account.

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows security identifier (SID) is a unique value that identifies a user or group account. ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: SIDs are used by Windows security in both security descriptors and access tokens.

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SIDs are used by Windows security in both security descriptors and access tokens. ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft SID)

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft SID) ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators.

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006). ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration.

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration. ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks. ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: Network devices such as routers and firewalls that connect multiple networks together may implement NAT during the process of passing packets between networks.

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network devices such as routers and firewalls that connect multiple networks together may implement NAT during the process of passing packets between networks. ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: When performing NAT, the network device will rewrite the source and/or destination addresses of the IP address header.

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When performing NAT, the network device will rewrite the source and/or destination addresses of the IP address header. ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: Some network designs require NAT for the packets to cross the border device.

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some network designs require NAT for the packets to cross the border device. ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: A typical example of this is environments where internal networks make use of non-Internet routable addresses.(Citation: RFC1918)

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A typical example of this is environments where internal networks make use of non-Internet routable addresses.(Citation: RFC1918) ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: When an adversary gains control of a network boundary device, they can either leverage existing NAT configurations to send traffic between two separated networks, or they can implement NAT configurations of their own design.

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When an adversary gains control of a network boundary device, they can either leverage existing NAT configurations to send traffic between two separated networks, or they can implement NAT configurations of their own design. ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of network designs that require NAT to function, this enables the adversary to overcome inherent routing limitations that would normally prevent them from accessing protected systems behind the border device.

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of network designs that require NAT to function, this enables the adversary to overcome inherent routing limitations that would normally prevent them from accessing protected systems behind the border device. ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of network designs that do not require NAT, address translation can be used by adversaries to obscure their activities, as changing the addresses of packets that traverse a network boundary device can make monitoring data transmissions more challenging for defenders.

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of network designs that do not require NAT, address translation can be used by adversaries to obscure their activities, as changing the addresses of packets that traverse a network boundary device can make monitoring data transmissions more challenging for defenders. ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to change the operating system of a network device, implementing their own custom NAT mechanisms to further obscure their activities

Output: T1599.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to change the operating system of a network device, implementing their own custom NAT mechanisms to further obscure their activities ### Response: T1599.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation.

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation. ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks. ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: Devices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks.

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Devices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks. ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: They achieve this by restricting traffic types to enforce organizational policy in an attempt to reduce the risk inherent in such connections.

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They achieve this by restricting traffic types to enforce organizational policy in an attempt to reduce the risk inherent in such connections. ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: Restriction of traffic can be achieved by prohibiting IP addresses, layer 4 protocol ports, or through deep packet inspection to identify applications.

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Restriction of traffic can be achieved by prohibiting IP addresses, layer 4 protocol ports, or through deep packet inspection to identify applications. ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: To participate with the rest of the network, these devices can be directly addressable or transparent, but their mode of operation has no bearing on how the adversary can bypass them when compromised.

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To participate with the rest of the network, these devices can be directly addressable or transparent, but their mode of operation has no bearing on how the adversary can bypass them when compromised. ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: When an adversary takes control of such a boundary device, they can bypass its policy enforcement to pass normally prohibited traffic across the trust boundary between the two separated networks without hinderance.

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When an adversary takes control of such a boundary device, they can bypass its policy enforcement to pass normally prohibited traffic across the trust boundary between the two separated networks without hinderance. ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: By achieving sufficient rights on the device, an adversary can reconfigure the device to allow the traffic they want, allowing them to then further achieve goals such as command and control via [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003) or exfiltration of data via [Traffic Duplication](https://attack.mitre.org/techniques/T1020/001).

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By achieving sufficient rights on the device, an adversary can reconfigure the device to allow the traffic they want, allowing them to then further achieve goals such as command and control via [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003) or exfiltration of data via [Traffic Duplication](https://attack.mitre.org/techniques/T1020/001). ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also target internal devices responsible for network segmentation and abuse these in conjunction with [Internal Proxy](https://attack.mitre.org/techniques/T1090/001) to achieve the same goals.(Citation: Kaspersky ThreatNeedle Feb 2021)

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also target internal devices responsible for network segmentation and abuse these in conjunction with [Internal Proxy](https://attack.mitre.org/techniques/T1090/001) to achieve the same goals.(Citation: Kaspersky ThreatNeedle Feb 2021) ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: In the cases where a border device separates two separate organizations, the adversary can also facilitate lateral movement into new victim environments.

Output: T1599

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the cases where a border device separates two separate organizations, the adversary can also facilitate lateral movement into new victim environments. ### Response: T1599.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Output: T1486

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. ### Response: T1486.


Instruction: List the MITRE techniques contained in the text.

Input: They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key.

Output: T1486

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. ### Response: T1486.


Instruction: List the MITRE techniques contained in the text.

Input: This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation:

Output: T1486

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: ### Response: T1486.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)

Output: T1486

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) ### Response: T1486.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers).

Output: T1486

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). ### Response: T1486.