Instruction: List the MITRE techniques contained in the text.

Input: For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation:

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials)

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary can then use this token to request data or perform actions the original account could not.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary can then use this token to request data or perform actions the original account could not. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input:
If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles)

Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles)

Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence)

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence) ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.

Output: T1550.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow. ### Response: T1550.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos authentication can be used as the first step to lateral movement to a remote system.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos authentication can be used as the first step to lateral movement to a remote system. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket)

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket) ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks)

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks) ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation:

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Campbell 2014)

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Campbell 2014) ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys.

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash)

Output: T1550.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash) ### Response: T1550.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Captured hashes are used with PtH to authenticate as that user.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Captured hashes are used with PtH to authenticate as that user. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Once authenticated, PtH may be used to perform actions on local or remote systems.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once authenticated, PtH may be used to perform actions on local or remote systems. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use stolen password hashes to "overpass the hash."

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use stolen password hashes to "overpass the hash." ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket.

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: attacks.(Citation: Stealthbits Overpass-the-Hash)

Output: T1550.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: attacks.(Citation: Stealthbits Overpass-the-Hash) ### Response: T1550.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input:
Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s).

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Output: T1550

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors. ### Response: T1550.


Instruction: List the MITRE techniques contained in the text.

Input: Remote desktop is a common feature in operating systems.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote desktop is a common feature in operating systems. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: TechNet Remote Desktop Services)

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: TechNet Remote Desktop Services) ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: There are other implementations and third-party tools that provide graphical access

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are other implementations and third-party tools that provide graphical access ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1015) technique for Persistence.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1015) technique for Persistence. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Alperovitch Malware)

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Alperovitch Malware) ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also perform RDP session hijacking which involves stealing a legitimate user's remote session.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also perform RDP session hijacking which involves stealing a legitimate user's remote session. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, a user is notified when someone else is trying to steal their session and prompted with a question.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, a user is notified when someone else is trying to steal their session and prompted with a question. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: With System permissions and using Terminal Services Console, <code>c:\windows\system32\tscon.exe

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With System permissions and using Terminal Services Console, <code>c:\windows\system32\tscon.exe ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: [session number to be stolen]</code>, an adversary can hijack a session without the need for credentials or prompts to the user.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [session number to be stolen]</code>, an adversary can hijack a session without the need for credentials or prompts to the user. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: RDP Hijacking Korznikov)

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: RDP Hijacking Korznikov) ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: This can be done remotely or locally and with active or disconnected sessions.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be done remotely or locally and with active or disconnected sessions. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: RDP Hijacking Medium)

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: RDP Hijacking Medium) ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: All of this can be done by using native Windows commands, but it has also been added as a feature in RedSnarf.

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All of this can be done by using native Windows commands, but it has also been added as a feature in RedSnarf. ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Kali Redsnarf)

Output: T1076

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Kali Redsnarf) ### Response: T1076.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search and gather information about victims from closed sources that can be used during targeting.

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search and gather information about victims from closed sources that can be used during targeting. ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds)

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds) ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation:

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input:
ZDNET Selling Data)

Adversaries may search in different closed databases depending on what information they seek to gather.

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ZDNET Selling Data)

Adversaries may search in different closed databases depending on what information they seek to gather. ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting.

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported.

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds)

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search in private threat intelligence vendor data to gather actionable information.

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search in private threat intelligence vendor data to gather actionable information. ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns.

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

Output: T1011.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. ### Response: T1011.001.


Instruction: List the MITRE techniques contained in the text.

Input: If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.

Output: T1011.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. ### Response: T1011.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may choose to do this if they have sufficient access and proximity.

Output: T1011.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may choose to do this if they have sufficient access and proximity. ### Response: T1011.001.


Instruction: List the MITRE techniques contained in the text.

Input: Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.

Output: T1011.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network. ### Response: T1011.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

Output: T1011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. ### Response: T1011.


Instruction: List the MITRE techniques contained in the text.

Input: If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.

Output: T1011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. ### Response: T1011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.

Output: T1011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network. ### Response: T1011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may collect data related to managed devices from configuration repositories.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may collect data related to managed devices from configuration repositories. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Configuration repositories may also facilitate remote access and administration of devices.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Configuration repositories may also facilitate remote access and administration of devices. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target these repositories in order to collect large quantities of sensitive system administration data.

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)

Output: T1602

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017) ### Response: T1602.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may access network configuration files to collect sensitive data about the device and the network.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may access network configuration files to collect sensitive data about the device and the network. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: The network configuration is a file containing parameters that determine the operation of the device.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The network configuration is a file containing parameters that determine the operation of the device. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.

Output: T1602.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis. ### Response: T1602.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather employee names that can be used during targeting.

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather employee names that can be used during targeting. ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1589.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1589.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather email addresses that can be used during targeting.

Output: T1589.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather email addresses that can be used during targeting. ### Response: T1589.002.


Instruction: List the MITRE techniques contained in the text.

Input: Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.

Output: T1589.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. ### Response: T1589.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation:

Output: T1589.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ### Response: T1589.002.


Instruction: List the MITRE techniques contained in the text.

Input: HackersArise Email)(Citation: CNET Leaks)

Output: T1589.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HackersArise Email)(Citation: CNET Leaks) ### Response: T1589.002.


Instruction: List the MITRE techniques contained in the text.

Input: Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum)

Output: T1589.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) ### Response: T1589.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance)

Output: T1589.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance) ### Response: T1589.002.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1589.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1589.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1589.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1589.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather credentials that can be used during targeting.

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather credentials that can be used during targeting. ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation:

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation: ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Register Uber)(Citation: Detectify Slack Tokens)(Citation:

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Register Uber)(Citation: Detectify Slack Tokens)(Citation: ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Forbes GitHub Creds)(Citation:

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Forbes GitHub Creds)(Citation: ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also purchase credentials from dark web or other black-markets.

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also purchase credentials from dark web or other black-markets. ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Finally, where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP).(Citation: Okta Scatter Swine 2022)

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Finally, where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP).(Citation: Okta Scatter Swine 2022) ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1589.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1589.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's identity that can be used during targeting.

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's identity that can be used during targeting. ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials.

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials. ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation:

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Forbes GitHub Creds)(Citation:

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Forbes GitHub Creds)(Citation: ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1589

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1589.


Instruction: List the MITRE techniques contained in the text.

Input: Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start.

Output: T1131

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. ### Response: T1131.


Instruction: List the MITRE techniques contained in the text.

Input: They provide support for multiple logon processes and multiple security protocols to the operating system.

Output: T1131

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They provide support for multiple logon processes and multiple security protocols to the operating system. ### Response: T1131.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MSDN Authentication Packages)

Output: T1131

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MSDN Authentication Packages) ### Response: T1131.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use the autostart mechanism provided by LSA Authentication Packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ with the key value of "Authentication Packages"=<target binary>.

Output: T1131

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use the autostart mechanism provided by LSA Authentication Packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ with the key value of "Authentication Packages"=<target binary>. ### Response: T1131.


Instruction: List the MITRE techniques contained in the text.

Input: The binary will then be executed by the system when the authentication packages are loaded.

Output: T1131

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The binary will then be executed by the system when the authentication packages are loaded. ### Response: T1131.


Instruction: List the MITRE techniques contained in the text.

Input: Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data). ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of extra window memory (EWM) to be appended to the allocated memory of each instance of that class.

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of extra window memory (EWM) to be appended to the allocated memory of each instance of that class. ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value.

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function) ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure.

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM. ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: Execution granted through EWM injection may take place in the address space of a separate live process.

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution granted through EWM injection may take place in the address space of a separate live process. ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this may allow access to both the target process's memory and possibly elevated privileges.

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this may allow access to both the target process's memory and possibly elevated privileges. ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread. ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Elastic Process Injection July 2017)

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017) ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process.

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)

Output: T1181

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013) ### Response: T1181.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown) ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel. ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti)

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti) ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries.

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github).

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: Most libraries include functionality to encrypt and/or compress data.

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most libraries include functionality to encrypt and/or compress data. ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows.

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. ### Response: T1560.002.