Instruction: List the MITRE techniques contained in the text.

Input: An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can target various layers of the application stack that is hosted on the system used to provide the service.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Botnets are commonly used to conduct DDoS attacks against networks and services.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Botnets are commonly used to conduct DDoS attacks against networks and services. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Large botnets can generate a significant amount of traffic from systems spread across the global internet.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Large botnets can generate a significant amount of traffic from systems spread across the global internet. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016) ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China) ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: For attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498). ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.

Output: T1499.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. ### Response: T1499.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, specific features in web applications may be highly resource intensive.

Output: T1499.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, specific features in web applications may be highly resource intensive. ### Response: T1499.003.


Instruction: List the MITRE techniques contained in the text.

Input: Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)

Output: T1499.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018) ### Response: T1499.003.


Instruction: List the MITRE techniques contained in the text.

Input: During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions.

Output: T1163

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. ### Response: T1163.


Instruction: List the MITRE techniques contained in the text.

Input: This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items).

Output: T1163

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). ### Response: T1163.


Instruction: List the MITRE techniques contained in the text.

Input: In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.

Output: T1163

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used. ### Response: T1163.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence).

Output: T1163

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence). ### Response: T1163.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
Supply chain compromise can take place at any stage of the supply chain including:

* Manipulation of development tools
* Manipulation of a development environment
* Manipulation of source code repositories (public or private)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Supply chain compromise can take place at any stage of the supply chain including:

* Manipulation of development tools
* Manipulation of a development environment
* Manipulation of source code repositories (public or private) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
* Manipulation of source code in open-source dependencies
* Manipulation of software update/distribution mechanisms
* Compromised/infected system images (multiple cases of removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Manipulation of source code in open-source dependencies
* Manipulation of software update/distribution mechanisms
* Compromised/infected system images (multiple cases of removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
Replacement of legitimate software with modified versions
*

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Replacement of legitimate software with modified versions
* ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
Sales of modified/counterfeit products to legitimate distributors
*

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sales of modified/counterfeit products to legitimate distributors
* ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input:
Shipment interdiction

While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation:

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Shipment interdiction

While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation:

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Command Five SK 2011)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Command Five SK 2011) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation:

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Symantec Elderwood Sept 2012)(Citation:

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Symantec Elderwood Sept 2012)(Citation: ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Avast CCleaner3 2018)(Citation: Command Five SK 2011)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Avast CCleaner3 2018)(Citation: Command Five SK 2011) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)

Output: T1195

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) ### Response: T1195.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise.

Output: T1195.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. ### Response: T1195.001.


Instruction: List the MITRE techniques contained in the text.

Input: Applications often depend on external software to function properly.

Output: T1195.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Applications often depend on external software to function properly. ### Response: T1195.001.


Instruction: List the MITRE techniques contained in the text.

Input: Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)

Output: T1195.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) ### Response: T1195.001.


Instruction: List the MITRE techniques contained in the text.

Input: Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.

Output: T1195.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. ### Response: T1195.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal capabilities that can be used during targeting.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal capabilities that can be used during targeting. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries).

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: SSL/TLS certificates are designed to instill trust.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SSL/TLS certificates are designed to instill trust. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise)

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)

After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)

After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation:

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT29 Microsoft 365 2022)

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT29 Microsoft 365 2022) ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting.

Output: T1583.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. ### Response: T1583.002.


Instruction: List the MITRE techniques contained in the text.

Input: During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)).

Output: T1583.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). ### Response: T1583.002.


Instruction: List the MITRE techniques contained in the text.

Input: Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations.

Output: T1583.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations. ### Response: T1583.002.


Instruction: List the MITRE techniques contained in the text.

Input: By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic ([DNS](https://attack.mitre.org/techniques/T1071/004)).

Output: T1583.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic ([DNS](https://attack.mitre.org/techniques/T1071/004)). ### Response: T1583.002.


Instruction: List the MITRE techniques contained in the text.

Input: With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.(Citation: Unit42 DNS Mar 2019)

Output: T1583.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.(Citation: Unit42 DNS Mar 2019) ### Response: T1583.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation:

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky StoneDrill 2017)(Citation:

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky StoneDrill 2017)(Citation: ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Unit 42 Shamoon3 2018)

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit 42 Shamoon3 2018) ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk.

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable.

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped.

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped. ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input:
On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco)

To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation:

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco)

To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky StoneDrill 2017)

Output: T1561.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky StoneDrill 2017) ### Response: T1561.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources. ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018)

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content.

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware)

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have also been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation:

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have also been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation: ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk are erased instead of individual files.

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk are erased instead of individual files. ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078),

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)

Output: T1561.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware) ### Response: T1561.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: With direct write access to a disk, adversaries may attempt to overwrite portions of disk data.

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR).

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: A complete wipe of all disk sectors may be attempted.

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A complete wipe of all disk sectors may be attempted. ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078),

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input:
[OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)

On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco)

Output: T1561

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)

On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco) ### Response: T1561.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Output: T1071

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. ### Response: T1071.


Instruction: List the MITRE techniques contained in the text.

Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Output: T1071

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ### Response: T1071.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS.

Output: T1071

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. ### Response: T1071.


Instruction: List the MITRE techniques contained in the text.

Input: For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.

Output: T1071

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP. ### Response: T1071.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: The DNS protocol serves an administrative function in computer networking and thus may be very common in environments.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: DNS traffic may also be allowed even before network authentication is completed.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DNS traffic may also be allowed even before network authentication is completed. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: DNS packets contain many fields and headers in which data can be concealed.

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DNS packets contain many fields and headers in which data can be concealed. ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling)

Output: T1071.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) ### Response: T1071.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials.

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials. ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)). ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance.

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets.

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API)

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019)

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019) ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources.

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.(Citation:

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: RedLock Instance Metadata API 2018)

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RedLock Instance Metadata API 2018) ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: The de facto standard across cloud service providers is to host the Instance Metadata API at http[:]//169.254.169.254.

Output: T1552.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The de facto standard across cloud service providers is to host the Instance Metadata API at http[:]//169.254.169.254. ### Response: T1552.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for common password storage locations to obtain user credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for common password storage locations to obtain user credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain.

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain. ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware)

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware) ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way)

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory.

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain) ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.

Output: T1615

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. ### Response: T1615.


Instruction: List the MITRE techniques contained in the text.

Input: Group Policy allows for centralized management of user and computer settings in Active Directory (AD).

Output: T1615

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Group Policy allows for centralized management of user and computer settings in Active Directory (AD). ### Response: T1615.


Instruction: List the MITRE techniques contained in the text.

Input: Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)

Output: T1615

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) ### Response: T1615.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire)

Output: T1615

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) ### Response: T1615.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.

Output: T1615

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit. ### Response: T1615.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use bootkits to persist on systems.

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use bootkits to persist on systems. ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR).

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Mandiant M Trends 2016)

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Mandiant M Trends 2016) ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS.

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: It is the location of the boot loader.

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is the location of the boot loader. ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Lau 2011)

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Lau 2011) ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: The MBR passes control of the boot process to the VBR.

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The MBR passes control of the boot process to the VBR. ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.

Output: T1542.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code. ### Response: T1542.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search connected removable media on computers they have compromised to find files of interest.

Output: T1025

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search connected removable media on computers they have compromised to find files of interest. ### Response: T1025.


Instruction: List the MITRE techniques contained in the text.

Input: Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration.

Output: T1025

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. ### Response: T1025.


Instruction: List the MITRE techniques contained in the text.

Input: Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.

Output: T1025

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information. ### Response: T1025.


Instruction: List the MITRE techniques contained in the text.

Input: Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.

Output: T1025

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media. ### Response: T1025.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.

Output: T1116

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. ### Response: T1116.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia Code Signing)

Output: T1116

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia Code Signing) ### Response: T1116.