Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190),

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), ### Response: T1587.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068),

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), ### Response: T1587.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)). ### Response: T1587.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop malware and malware components that can be used during targeting.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop malware and malware components that can be used during targeting. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: As with legitimate development efforts, different skill sets may be required for developing malware.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with legitimate development efforts, different skill sets may be required for developing malware. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: The skills needed may be located in-house, or may need to be contracted out.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The skills needed may be located in-house, or may need to be contracted out. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure.

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)

Output: T1587.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29) ### Response: T1587.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may build capabilities that can be used during targeting.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may build capabilities that can be used during targeting. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Talos Promethium June 2020)

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos Promethium June 2020) ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: As with legitimate development efforts, different skill sets may be required for developing capabilities.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with legitimate development efforts, different skill sets may be required for developing capabilities. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: The skills needed may be located in-house, or may need to be contracted out.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The skills needed may be located in-house, or may need to be contracted out. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications.

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution. ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE.

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: Despite being superseded by COM, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Despite being superseded by COM, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017)

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft DDE Advisory Nov 2017)

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft DDE Advisory Nov 2017) ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use DDE to execute arbitrary commands.

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use DDE to execute arbitrary commands. ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016)

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros.

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to command line execution.

Output: T1173

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to command line execution. ### Response: T1173.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Additional custom tools likely exist as well.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional custom tools likely exist as well. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input: By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory)

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory) ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015)

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015) ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input: The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input:
* Volume Shadow Copy
* secretsdump.py
* Using the in-built Windows tool, ntdsutil.exe
* Invoke-NinjaCopy

Output: T1003.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Volume Shadow Copy
* secretsdump.py
* Using the in-built Windows tool, ntdsutil.exe
* Invoke-NinjaCopy ### Response: T1003.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may collect data related to managed devices from configuration repositories.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may collect data related to managed devices from configuration repositories. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Configuration repositories may also facilitate remote access and administration of devices.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Configuration repositories may also facilitate remote access and administration of devices. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target these repositories in order to collect large quantities of sensitive system administration data.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017) ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID).

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables.

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation:

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: SANS Information Security Reading Room

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SANS Information Security Reading Room ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: Securing SNMP Securing SNMP).

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Securing SNMP Securing SNMP). ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: The MIB may also contain device operational information, including running configuration, routing table, and interface details.

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The MIB may also contain device operational information, including running configuration, routing table, and interface details. ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)

Output: T1602.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) ### Response: T1602.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obfuscate command and control traffic to make it more difficult to detect.

Output: T1001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obfuscate command and control traffic to make it more difficult to detect. ### Response: T1001.


Instruction: List the MITRE techniques contained in the text.

Input: Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen.

Output: T1001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. ### Response: T1001.


Instruction: List the MITRE techniques contained in the text.

Input: This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

Output: T1001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols. ### Response: T1001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

Output: T1001.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. ### Response: T1001.002.


Instruction: List the MITRE techniques contained in the text.

Input: Steganographic techniques can be used to hide data in digital messages that are transferred between systems.

Output: T1001.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Steganographic techniques can be used to hide data in digital messages that are transferred between systems. ### Response: T1001.002.


Instruction: List the MITRE techniques contained in the text.

Input: This hidden information can be used for command and control of compromised systems.

Output: T1001.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This hidden information can be used for command and control of compromised systems. ### Response: T1001.002.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.

Output: T1001.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control. ### Response: T1001.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may rely upon specific actions by a user in order to gain execution.

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may rely upon specific actions by a user in order to gain execution. ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link.

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it.

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also deceive users into performing actions such as enabling [Remote Access Software](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary, or downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also deceive users into performing actions such as enabling [Remote Access Software](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary, or downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction.

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Software](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery)

Output: T1204

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Software](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery) ### Response: T1204.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may rely upon a user clicking a malicious link in order to gain execution.

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may rely upon a user clicking a malicious link in order to gain execution. ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: Users may be subjected to social engineering to get them to click on a link that will lead to code execution.

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users may be subjected to social engineering to get them to click on a link that will lead to code execution. ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002).

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).

Output: T1204.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002). ### Response: T1204.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input:
Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: These tokens are typically stolen from users or services and used in lieu of login credentials.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These tokens are typically stolen from users or services and used in lieu of login credentials. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019)

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: OAuth is one commonly implemented framework that issues tokens to users for access to systems.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: OAuth is one commonly implemented framework that issues tokens to users for access to systems. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta) ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input:
For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)

Compromised access tokens may be used as an initial step in compromising other services.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)

Compromised access tokens may be used as an initial step in compromising other services. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation:

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials)

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary can then use this token to request data or perform actions the original account could not.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary can then use this token to request data or perform actions the original account could not. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input:
If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles)

Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles)

Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence)

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence) ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation:

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may achieve the same goal by modifying or extending features of the kernel.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may achieve the same goal by modifying or extending features of the kernel. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem)

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target LSASS drivers to obtain persistence.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target LSASS drivers to obtain persistence. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.

Output: T1547.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads. ### Response: T1547.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse system services or daemons to execute commands or programs.

Output: T1569

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse system services or daemons to execute commands or programs. ### Response: T1569.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can execute malicious content by interacting with or creating services either locally or remotely.

Output: T1569

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can execute malicious content by interacting with or creating services either locally or remotely. ### Response: T1569.


Instruction: List the MITRE techniques contained in the text.

Input: Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.

Output: T1569

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution. ### Response: T1569.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.

Output: T1569.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. ### Response: T1569.002.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager)

Output: T1569.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) ### Response: T1569.002.


Instruction: List the MITRE techniques contained in the text.

Input: The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).

Output: T1569.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039). ### Response: T1569.002.


Instruction: List the MITRE techniques contained in the text.

Input: [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation:

Output: T1569.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: ### Response: T1569.002.


Instruction: List the MITRE techniques contained in the text.

Input: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.

Output: T1569.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and sc.exe can accept remote servers as arguments and may be used to conduct remote execution. ### Response: T1569.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage these mechanisms to execute malicious content.

Output: T1569.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage these mechanisms to execute malicious content. ### Response: T1569.002.


Instruction: List the MITRE techniques contained in the text.

Input: This can be done by either executing a new or modified service.

Output: T1569.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be done by either executing a new or modified service. ### Response: T1569.002.


Instruction: List the MITRE techniques contained in the text.

Input: This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.

Output: T1569.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation. ### Response: T1569.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Output: T1078

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. ### Response: T1078.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network.

Output: T1078

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. ### Response: T1078.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Output: T1078

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. ### Response: T1078.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization.

Output: T1078

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. ### Response: T1078.


Instruction: List the MITRE techniques contained in the text.

Input: Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare)

Output: T1078

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare) ### Response: T1078.


Instruction: List the MITRE techniques contained in the text.

Input: The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft)

Output: T1078

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft) ### Response: T1078.


Instruction: List the MITRE techniques contained in the text.

Input: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud Accounts can exist solely in the cloud or be hybrid joined between on-premises systems and the cloud through federation with other identity sources such as Windows Active Directory.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud Accounts can exist solely in the cloud or be hybrid joined between on-premises systems and the cloud through federation with other identity sources such as Windows Active Directory. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation:

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft Deploying AD Federation)

Service or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110),

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Deploying AD Federation)

Service or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110), ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: Federated accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Federated accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may create long lasting

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may create long lasting ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: Such credentials may also be used to bypass security controls such as multi-factor authentication.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such credentials may also be used to bypass security controls such as multi-factor authentication. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: Misconfigurations in role assignments or role assumption policies may allow an adversary to use these mechanisms to leverage permissions outside the intended scope of the account.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Misconfigurations in role assignments or role assumption policies may allow an adversary to use these mechanisms to leverage permissions outside the intended scope of the account. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: Such over privileged accounts may be used to harvest sensitive data from online storage accounts and databases through [Cloud API](https://attack.mitre.org/techniques/T1059/009) or other methods.

Output: T1078.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such over privileged accounts may be used to harvest sensitive data from online storage accounts and databases through [Cloud API](https://attack.mitre.org/techniques/T1059/009) or other methods. ### Response: T1078.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

Output: T1480

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. ### Response: T1480.


Instruction: List the MITRE techniques contained in the text.

Input: Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation:

Output: T1480

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: ### Response: T1480.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye Kevin Mandia Guardrails)

Output: T1480

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye Kevin Mandia Guardrails) ### Response: T1480.


Instruction: List the MITRE techniques contained in the text.

Input: Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)

Output: T1480

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019) ### Response: T1480.


Instruction: List the MITRE techniques contained in the text.

Input: Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.

Output: T1480

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. ### Response: T1480.


Instruction: List the MITRE techniques contained in the text.

Input: This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497).

Output: T1480

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). ### Response: T1480.


Instruction: List the MITRE techniques contained in the text.

Input: While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.

Output: T1480

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match. ### Response: T1480.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

Output: T1480.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. ### Response: T1480.001.


Instruction: List the MITRE techniques contained in the text.

Input: Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target.

Output: T1480.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. ### Response: T1480.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)

Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload.

Output: T1480.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)

Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload. ### Response: T1480.001.


Instruction: List the MITRE techniques contained in the text.

Input: Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.(Citation: Kaspersky Gauss Whitepaper)(Citation:

Output: T1480.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.(Citation: Kaspersky Gauss Whitepaper)(Citation: ### Response: T1480.001.


Instruction: List the MITRE techniques contained in the text.

Input: Proofpoint Router Malvertising)(Citation:

Output: T1480.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Proofpoint Router Malvertising)(Citation: ### Response: T1480.001.


Instruction: List the MITRE techniques contained in the text.

Input: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation:

Output: T1480.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: ### Response: T1480.001.