Instruction: List the MITRE techniques contained in the text.

Input: [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote [Execution](https://attack.mitre.org/tactics/TA0002) as part of [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and/or to run a process under the context of a specified account (such as SYSTEM).

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote [Execution](https://attack.mitre.org/tactics/TA0002) as part of [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and/or to run a process under the context of a specified account (such as SYSTEM). ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: In Linux environments, adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands.

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Linux environments, adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands. ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at)

Output: T1053.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at) ### Response: T1053.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation:

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Task Scheduler Security)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet Task Scheduler Security) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec)

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: The Msiexec.exe binary may also be digitally signed by Microsoft.

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Msiexec.exe binary may also be digitally signed by Microsoft. ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018)

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse.

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.(Citation:

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.(Citation: ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft AlwaysInstallElevated 2018)

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft AlwaysInstallElevated 2018) ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: MacOS provides the option to list specific applications to run when a user logs in.

Output: T1162

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MacOS provides the option to list specific applications to run when a user logs in. ### Response: T1162.


Instruction: List the MITRE techniques contained in the text.

Input: These applications run under the logged in user's context, and will be started every time the user logs in.

Output: T1162

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These applications run under the logged in user's context, and will be started every time the user logs in. ### Response: T1162.


Instruction: List the MITRE techniques contained in the text.

Input: Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them (Citation: Adding Login Items).

Output: T1162

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them (Citation: Adding Login Items). ### Response: T1162.


Instruction: List the MITRE techniques contained in the text.

Input: Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items).

Output: T1162

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). ### Response: T1162.


Instruction: List the MITRE techniques contained in the text.

Input: These login items are stored in the user's ~/Library/Preferences/ directory in a plist file called com.apple.loginitems.plist (Citation: Methods of Mac Malware Persistence).

Output: T1162

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These login items are stored in the user's ~/Library/Preferences/ directory in a plist file called com.apple.loginitems.plist (Citation: Methods of Mac Malware Persistence). ### Response: T1162.


Instruction: List the MITRE techniques contained in the text.

Input: Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to ‘Hide’ the window.

Output: T1162

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to ‘Hide’ the window. ### Response: T1162.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware).

Output: T1162

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). ### Response: T1162.


Instruction: List the MITRE techniques contained in the text.

Input: The API method <code> SMLoginItemSetEnabled </code> can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1155) can do this as well  (Citation: Adding Login Items).

Output: T1162

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The API method <code> SMLoginItemSetEnabled </code> can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1155) can do this as well  (Citation: Adding Login Items). ### Response: T1162.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's networks that can be used during targeting.

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's networks that can be used during targeting. ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation:

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS) ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting.

Output: T1590.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. ### Response: T1590.003.


Instruction: List the MITRE techniques contained in the text.

Input: Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access.

Output: T1590.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. ### Response: T1590.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1590.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1590.003.


Instruction: List the MITRE techniques contained in the text.

Input: Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests)

Output: T1590.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) ### Response: T1590.003.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1590.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1590.003.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1590.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1590.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Network DoS can be performed by exhausting the network bandwidth services rely on.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Network DoS can be performed by exhausting the network bandwidth services rely on. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Example resources include specific websites, email services, DNS, and web-based applications.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example resources include specific websites, email services, DNS, and web-based applications. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: For DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499).

Output: T1498

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499). ### Response: T1498.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: This third-party server is commonly termed a reflector.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This third-party server is commonly termed a reflector. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: Likewise, one or more reflectors may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017)

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Likewise, one or more reflectors may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017) ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume.

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018)

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018) ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018)

Output: T1498.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018) ### Response: T1498.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078). ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.

Output: T1556

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. ### Response: T1556.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: Windows password filters are password policy enforcement mechanisms for both domain and local accounts.

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows password filters are password policy enforcement mechanisms for both domain and local accounts. ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: Filters are implemented as DLLs containing a method to validate potential passwords against password policies.

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Filters are implemented as DLLs containing a method to validate potential passwords against password policies. ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter.

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: Any potential changes cannot take effect until every registered filter acknowledges validation.

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Any potential changes cannot take effect until every registered filter acknowledges validation. ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains.

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: To perform proper validation, filters must receive plain-text credentials from the LSA.

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To perform proper validation, filters must receive plain-text credentials from the LSA. ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013)

Output: T1556.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013) ### Response: T1556.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application.

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)

Output: T1505

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW) ### Response: T1505.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse components of Terminal Services to enable persistent access to systems.

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse components of Terminal Services to enable persistent access to systems. ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts.

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services)

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services) ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: [Windows Service](https://attack.mitre.org/techniques/T1543/003)s that are run as a "generic" process (ex: svchost.exe) load the service's DLL file, the location of which is stored in a Registry entry named ServiceDll.(Citation: Microsoft System Services Fundamentals)

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Windows Service](https://attack.mitre.org/techniques/T1543/003)s that are run as a "generic" process (ex: svchost.exe) load the service's DLL file, the location of which is stored in a Registry entry named ServiceDll.(Citation: Microsoft System Services Fundamentals) ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: The termsrv.dll file, typically stored in `%SystemRoot%\System32\`, is the default

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The termsrv.dll file, typically stored in `%SystemRoot%\System32\`, is the default  ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: ServiceDll</code> value for Terminal Services in `HKLM\System\CurrentControlSet\services\TermService\Parameters\`.

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ServiceDll</code> value for Terminal Services in `HKLM\System\CurrentControlSet\services\TermService\Parameters\`. ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify and/or replace the Terminal Services DLL to enable persistent access to victimized hosts.(Citation: James TermServ DLL) Modifications to this DLL could be done to execute arbitrary payloads (while also potentially preserving normal termsrv.dll functionality) as well as to simply enable abusable features of Terminal Services.

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify and/or replace the Terminal Services DLL to enable persistent access to victimized hosts.(Citation: James TermServ DLL) Modifications to this DLL could be done to execute arbitrary payloads (while also potentially preserving normal termsrv.dll functionality) as well as to simply enable abusable features of Terminal Services. ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary may enable features such as concurrent [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) sessions by either patching the termsrv.dll file or modifying the ServiceDll value to point to a DLL that provides increased RDP functionality.(Citation: Windows OS Hub RDP)(Citation: RDPWrap Github)

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary may enable features such as concurrent [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) sessions by either patching the termsrv.dll file or modifying the ServiceDll value to point to a DLL that provides increased RDP functionality.(Citation: Windows OS Hub RDP)(Citation: RDPWrap Github) ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: On a non-server Windows OS this increased functionality may also enable an adversary to avoid Terminal Services prompts that warn/log out users of a system when a new RDP session is created.

Output: T1505.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On a non-server Windows OS this increased functionality may also enable an adversary to avoid Terminal Services prompts that warn/log out users of a system when a new RDP session is created. ### Response: T1505.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005). ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Powershell Remote Commands)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Powershell Remote Commands)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Cisco IOS Software Integrity Assurance - Command History)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cisco IOS Software Integrity Assurance - Command History)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Shell Execution in Python)

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Shell Execution in Python) ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse AppleScript for execution.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse AppleScript for execution. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript)

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: These AppleEvent messages can be sent independently or easily scripted with AppleScript.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These AppleEvent messages can be sent independently or easily scripted with AppleScript. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Scripts can be run from the command-line via osascript /path/to/script or osascript -e "script here".

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripts can be run from the command-line via osascript /path/to/script or osascript -e "script here". ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: AppleScripts can also be executed as plain text shell scripts by adding <code>#!/usr/bin/osascript</code> to the start of the script file.(Citation:

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AppleScripts can also be executed as plain text shell scripts by adding <code>#!/usr/bin/osascript</code> to the start of the script file.(Citation: ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: SentinelOne AppleScript)

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SentinelOne AppleScript) ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: AppleScripts do not need to call osascript to execute.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AppleScripts do not need to call osascript to execute. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: However, they may be executed from within mach-O binaries by using the macOS

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, they may be executed from within mach-O binaries by using the macOS ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Native API](https://attack.mitre.org/techniques/T1106)s NSAppleScript or OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Native API](https://attack.mitre.org/techniques/T1106)s NSAppleScript or OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely.

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation:

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: SentinelOne macOS Red Team)

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SentinelOne macOS Red Team) ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs)

Output: T1059.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs) ### Response: T1059.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Internet browser extensions to establish persistent access to victim systems.

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers.

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition) ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system.

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers)

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions. ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files.

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input:
In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)

Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation:

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)

Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: Chrome Extension Crypto Miner)(Citation: ICEBRG

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Chrome Extension Crypto Miner)(Citation: ICEBRG ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input:
Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension)

There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet)

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension)

There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet) ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware)

Output: T1176

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware) ### Response: T1176.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Example services include websites, email services, DNS, and web-based applications.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example services include websites, email services, DNS, and web-based applications. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can target various layers of the application stack that is hosted on the system used to provide the service.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Botnets are commonly used to conduct DDoS attacks against networks and services.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Botnets are commonly used to conduct DDoS attacks against networks and services. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Large botnets can generate a significant amount of traffic from systems spread across the global internet.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Large botnets can generate a significant amount of traffic from systems spread across the global internet. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016) ### Response: T1499.


Instruction: List the MITRE techniques contained in the text.

Input: In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume.

Output: T1499

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. ### Response: T1499.