Instruction: List the MITRE techniques contained in the text.

Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft DART Case Report 001)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft DART Case Report 001) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Malware Persistence on OS X)(Citation: amnesia malware)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware Persistence on OS X)(Citation: amnesia malware) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: IFEOs enable a developer to attach a debugger to an application.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IFEOs enable a developer to attach a debugger to an application. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., <code>C:\dbg\ntsd.exe

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., <code>C:\dbg\ntsd.exe ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: -g  notepad.exe</code>).

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: -g  notepad.exe</code>). ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Dev Blog IFEO Mar 2010)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Dev Blog IFEO Mar 2010) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: File Execution Options\<executable> where <executable> is the binary on which the debugger is attached.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File Execution Options\<executable> where <executable> is the binary on which the debugger is attached. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Dev Blog IFEO Mar 2010)

Output: T1546.012


Instruction: List the MITRE techniques contained in the text.

Input: IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process).

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)

Similar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for an accessibility program (ex: utilman.exe).

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)

Similar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for an accessibility program (ex: utilman.exe). ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the "debugger" program to be executed with SYSTEM privileges.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the "debugger" program to be executed with SYSTEM privileges. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Tilbury 2014)

Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Tilbury 2014)

Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Elastic Process Injection July 2017)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: Malware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications.

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications. ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)

Output: T1546.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008) ### Response: T1546.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads.

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe)

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: The Odbcconf.exe binary may be digitally signed by Microsoft.

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Odbcconf.exe binary may be digitally signed by Microsoft. ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse.

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: /A

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: /A ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: {REGSVR

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: {REGSVR ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: "C:\Users\Public\file.dll"}</code>).

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: "C:\Users\Public\file.dll"}</code>). ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation:

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: TrendMicro Cobalt Group Nov 2017)

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TrendMicro Cobalt Group Nov 2017) ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting.

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation:

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: SecurityTrails Google Hacking)(Citation:

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SecurityTrails Google Hacking)(Citation: ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: ExploitDB

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ExploitDB ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: GoogleHacking)

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GoogleHacking) ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search in different online sites depending on what information they seek to gather.

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search in different online sites depending on what information they seek to gather. ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).

Output: T1593

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)). ### Response: T1593.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use search engines to collect information about victims that can be used during targeting.

Output: T1593.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use search engines to collect information about victims that can be used during targeting. ### Response: T1593.002.


Instruction: List the MITRE techniques contained in the text.

Input: Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation:

Output: T1593.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: ### Response: T1593.002.


Instruction: List the MITRE techniques contained in the text.

Input: SecurityTrails Google Hacking)(Citation:

Output: T1593.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SecurityTrails Google Hacking)(Citation: ### Response: T1593.002.


Instruction: List the MITRE techniques contained in the text.

Input: ExploitDB

Output: T1593.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ExploitDB ### Response: T1593.002.


Instruction: List the MITRE techniques contained in the text.

Input: GoogleHacking)

Output: T1593.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GoogleHacking) ### Response: T1593.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may craft various search engine queries depending on what information they seek to gather.

Output: T1593.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may craft various search engine queries depending on what information they seek to gather. ### Response: T1593.002.


Instruction: List the MITRE techniques contained in the text.

Input: Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials.

Output: T1593.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. ### Response: T1593.002.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).

Output: T1593.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). ### Response: T1593.002.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain.

Output: T1177

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. ### Response: T1177.


Instruction: List the MITRE techniques contained in the text.

Input: The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication.

Output: T1177

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. ### Response: T1177.


Instruction: List the MITRE techniques contained in the text.

Input: The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.

Output: T1177

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. ### Response: T1177.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Security Subsystem)

Output: T1177

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Security Subsystem) ### Response: T1177.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target lsass.exe drivers to obtain execution and/or persistence.

Output: T1177

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target lsass.exe drivers to obtain execution and/or persistence. ### Response: T1177.


Instruction: List the MITRE techniques contained in the text.

Input: By either replacing or adding illegitimate drivers (e.g., [DLL Side-Loading](https://attack.mitre.org/techniques/T1073) or [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038)), an adversary can achieve arbitrary code execution triggered by continuous LSA operations.

Output: T1177

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By either replacing or adding illegitimate drivers (e.g., [DLL Side-Loading](https://attack.mitre.org/techniques/T1073) or [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038)), an adversary can achieve arbitrary code execution triggered by continuous LSA operations. ### Response: T1177.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's organization that can be used during targeting.

Output: T1591

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's organization that can be used during targeting. ### Response: T1591.


Instruction: List the MITRE techniques contained in the text.

Input: Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.

Output: T1591

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. ### Response: T1591.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1591

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1591.


Instruction: List the MITRE techniques contained in the text.

Input: Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search)

Output: T1591

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) ### Response: T1591.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1591

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1591.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's business relationships that can be used during targeting.

Output: T1591.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's business relationships that can be used during targeting. ### Response: T1591.002.


Instruction: List the MITRE techniques contained in the text.

Input: Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access.

Output: T1591.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. ### Response: T1591.002.


Instruction: List the MITRE techniques contained in the text.

Input: This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.

Output: T1591.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources. ### Response: T1591.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1591.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1591.002.


Instruction: List the MITRE techniques contained in the text.

Input: Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)

Output: T1591.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) ### Response: T1591.002.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195),

Output: T1591.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195), ### Response: T1591.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1591.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1591.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.

Output: T1548

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. ### Response: T1548.


Instruction: List the MITRE techniques contained in the text.

Input: Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine.

Output: T1548

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. ### Response: T1548.


Instruction: List the MITRE techniques contained in the text.

Input: Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.

Output: T1548

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. ### Response: T1548.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Output: T1548

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system. ### Response: T1548.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: Just-in-time access is a mechanism for granting additional roles to cloud accounts in a granular, temporary manner.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Just-in-time access is a mechanism for granting additional roles to cloud accounts in a granular, temporary manner. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: This allows accounts to operate with only the permissions they need on a daily basis, and to request additional permissions as necessary.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This allows accounts to operate with only the permissions they need on a daily basis, and to request additional permissions as necessary. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes just-in-time access requests are configured to require manual approval, while other times the desired permissions are automatically granted.(Citation:

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes just-in-time access requests are configured to require manual approval, while other times the desired permissions are automatically granted.(Citation: ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input:
Google Cloud Just in Time Access 2023)(Citation: Azure Just in Time Access 2023)

Account impersonation allows user or service accounts to temporarily act with the permissions of another account.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Google Cloud Just in Time Access 2023)(Citation: Azure Just in Time Access 2023)

Account impersonation allows user or service accounts to temporarily act with the permissions of another account. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: For example, in GCP users with the `iam.serviceAccountTokenCreator` role can create temporary access tokens or sign arbitrary payloads with the permissions of a service account.(Citation: Google Cloud Service Account Authentication Roles)

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, in GCP users with the `iam.serviceAccountTokenCreator` role can create temporary access tokens or sign arbitrary payloads with the permissions of a service account.(Citation: Google Cloud Service Account Authentication Roles) ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: In Exchange Online, the `ApplicationImpersonation` role allows a service account to use the permissions associated with specified user accounts.(Citation:

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Exchange Online, the `ApplicationImpersonation` role allows a service account to use the permissions associated with specified user accounts.(Citation: ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft Impersonation and EWS in Exchange)

Many cloud environments also include mechanisms for users to pass roles to resources that allow them to perform tasks and authenticate to other services.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Impersonation and EWS in Exchange)

Many cloud environments also include mechanisms for users to pass roles to resources that allow them to perform tasks and authenticate to other services. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: While the user that creates the resource does not directly assume the role they pass to it, they may still be able to take advantage of the role's access -- for example, by configuring the resource to perform certain actions with the permissions it has been granted.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While the user that creates the resource does not directly assume the role they pass to it, they may still be able to take advantage of the role's access -- for example, by configuring the resource to perform certain actions with the permissions it has been granted. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input:
In AWS, users with the `PassRole` permission can allow a service they create to assume a given role, while in GCP, users with the `iam.serviceAccountUser` role can attach a service account to a resource.(Citation: AWS PassRole)(Citation: Google Cloud Service Account Authentication Roles)

While users require specific role assignments in order to use any of these features, cloud administrators may misconfigure permissions.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In AWS, users with the `PassRole` permission can allow a service they create to assume a given role, while in GCP, users with the `iam.serviceAccountUser` role can attach a service account to a resource.(Citation: AWS PassRole)(Citation: Google Cloud Service Account Authentication Roles)

While users require specific role assignments in order to use any of these features, cloud administrators may misconfigure permissions. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input:
This could result in escalation paths that allow adversaries to gain access to resources beyond what was originally intended.(Citation: Rhino Google Cloud Privilege Escalation)(Citation: Rhino Security Labs AWS Privilege Escalation)

**Note:** this technique is distinct from [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003), which involves assigning permanent roles to accounts rather than abusing existing permissions structures to gain temporarily elevated access to resources.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This could result in escalation paths that allow adversaries to gain access to resources beyond what was originally intended.(Citation: Rhino Google Cloud Privilege Escalation)(Citation: Rhino Security Labs AWS Privilege Escalation)

**Note:** this technique is distinct from [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003), which involves assigning permanent roles to accounts rather than abusing existing permissions structures to gain temporarily elevated access to resources. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries that compromise a sufficiently privileged account may grant another account they control

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries that compromise a sufficiently privileged account may grant another account they control ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) that would allow them to also abuse these features.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) that would allow them to also abuse these features. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: This may also allow for greater stealth than would be had by directly using the highly privileged account, especially when logs do not clarify when role impersonation is taking place.(Citation: CrowdStrike StellarParticle January 2022)

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also allow for greater stealth than would be had by directly using the highly privileged account, especially when logs do not clarify when role impersonation is taking place.(Citation: CrowdStrike StellarParticle January 2022) ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information.

Output: T1125

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. ### Response: T1125.


Instruction: List the MITRE techniques contained in the text.

Input: Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

Output: T1125

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. ### Response: T1125.


Instruction: List the MITRE techniques contained in the text.

Input: Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images.

Output: T1125

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. ### Response: T1125.


Instruction: List the MITRE techniques contained in the text.

Input: Video or image files may be written to disk and exfiltrated later.

Output: T1125

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Video or image files may be written to disk and exfiltrated later. ### Response: T1125.


Instruction: List the MITRE techniques contained in the text.

Input: This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen.

Output: T1125

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen. ### Response: T1125.


Instruction: List the MITRE techniques contained in the text.

Input: In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.

Output: T1125

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. ### Response: T1125.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: objective-see 2017 review)

Output: T1125

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: objective-see 2017 review) ### Response: T1125.


Instruction: List the MITRE techniques contained in the text.

Input: In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called com.apple.quarantine.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called com.apple.quarantine. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: This attribute is read by Apple's Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This attribute is read by Apple's Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: Apps loaded onto the system from USB flash drive, optical disk, external hard drive, or even from a drive shared over the local network won’t set this flag.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apps loaded onto the system from USB flash drive, optical disk, external hard drive, or even from a drive shared over the local network won’t set this flag. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, other utilities or events like drive-by downloads don’t necessarily set it either.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, other utilities or events like drive-by downloads don’t necessarily set it either. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: This completely bypasses the built-in Gatekeeper check.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This completely bypasses the built-in Gatekeeper check. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Methods of Mac Malware Persistence)

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Methods of Mac Malware Persistence) ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: The presence of the quarantine flag can be checked by the xattr command <code>xattr

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The presence of the quarantine flag can be checked by the xattr command <code>xattr ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: /path/to/MyApp.app for com.apple.quarantine.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: /path/to/MyApp.app for com.apple.quarantine. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, given sudo access or elevated permission, this attribute can be removed with xattr as well, <code>sudo

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, given sudo access or elevated permission, this attribute can be removed with xattr as well, <code>sudo ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: xattr -r

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: xattr -r ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: -d com.apple.quarantine /path/to/MyApp.app</code>.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: -d com.apple.quarantine /path/to/MyApp.app</code>. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Clearing quarantine attribute) (Citation: OceanLotus for OS X)

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Clearing quarantine attribute) (Citation: OceanLotus for OS X) ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: In typical operation, a file will be downloaded from the internet and given a quarantine flag before being saved to disk.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In typical operation, a file will be downloaded from the internet and given a quarantine flag before being saved to disk. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: When the user tries to open the file or application, macOS’s gatekeeper will step in and check for the presence of this flag.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the user tries to open the file or application, macOS’s gatekeeper will step in and check for the presence of this flag. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: If it exists, then macOS will then prompt the user to confirmation that they want to run the program and will even provide the URL where the application came from.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If it exists, then macOS will then prompt the user to confirmation that they want to run the program and will even provide the URL where the application came from. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: However, this is all based on the file being downloaded from a quarantine-savvy application.

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, this is all based on the file being downloaded from a quarantine-savvy application. ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Bypassing Gatekeeper)

Output: T1144

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Bypassing Gatekeeper) ### Response: T1144.


Instruction: List the MITRE techniques contained in the text.

Input: Software packing is a method of compressing or encrypting an executable.

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Software packing is a method of compressing or encrypting an executable. ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: Packing an executable changes the file signature in an attempt to avoid signature-based detection.

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Packing an executable changes the file signature in an attempt to avoid signature-based detection. ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: Most decompression techniques decompress the executable code in memory.

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most decompression techniques decompress the executable code in memory. ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities used to perform software packing are called packers.

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities used to perform software packing are called packers. ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: Example packers are MPRESS and UPX.

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example packers are MPRESS and UPX. ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses. ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use virtual machine software protection as a form of software packing to protect their code.

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use virtual machine software protection as a form of software packing to protect their code. ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run.

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)

Output: T1045

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) ### Response: T1045.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Process injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: These implementations exist for every major OS but are typically platform specific.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These implementations exist for every major OS but are typically platform specific. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Where to use TxF)

Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Where to use TxF)

Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: BlackHat Process Doppelgänging Dec 2017)

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: BlackHat Process Doppelgänging Dec 2017) ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055).

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055). ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), process doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), process doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: Process doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: BlackHat Process Doppelgänging Dec 2017)

Output: T1055.013


Instruction: List the MITRE techniques contained in the text.

Input:
Process Doppelgänging is implemented in 4 steps (Citation: BlackHat Process Doppelgänging Dec 2017):

* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process Doppelgänging is implemented in 4 steps (Citation: BlackHat Process Doppelgänging Dec 2017):

* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: These changes will be isolated and only visible within the context of the transaction.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These changes will be isolated and only visible within the context of the transaction. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: * Load – Create a shared section of memory and load the malicious executable.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Load – Create a shared section of memory and load the malicious executable. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: Rollback – Undo changes to original executable, effectively removing malicious code from the file system.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rollback – Undo changes to original executable, effectively removing malicious code from the file system. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: * Animate – Create a process from the tainted section of memory and initiate execution.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Animate – Create a process from the tainted section of memory and initiate execution. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: However, execution via process doppelgänging may evade detection from security products since the execution is masked under a legitimate process.

Output: T1055.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, execution via process doppelgänging may evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. ### Response: T1016.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087),

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), ### Response: T1016.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns.

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns. ### Response: T1016.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may collect various types of information about Wi-Fi networks from hosts.

Output: T1016.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may collect various types of information about Wi-Fi networks from hosts. ### Response: T1016.002.